| +OWASP® ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. The ESAPI for Java library is designed to make it easier for programmers to retrofit security into existing applications. ESAPI for Java also serves as a solid foundation for new development. + | +
[GHSA-q77q-vx4q-xx6q](https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-q77q-vx4q-xx6q)|Improper sanitization of user-controlled input permitted by an incorrect regular expression in an ESAPI configuration file can result in that input being unintentionally executing javascript: URLs, resulting in Cross-Site Scripting (XSS).|[CWE-79](https://cwe.mitre.org/data/definitions/79.html)|[CVE-2022-24891](https://nvd.nist.gov/vuln/detail/CVE-2022-24891)|A malformed regular expression in ESAPI’s default AntiSamy policy file, “antisamy-esapi.xml”, accidentally allowed the “:” character to match as a part of the “onsiteURL” regular expression. This allowed 'javascript:' pseudo-URIs to slip past ESAPI which could result in XSS vulnerabilities. Note that this vulnerability dates back at least to the ESAPI 1.4 release.|ESAPI 1.4 and all ESAPI 2.x versions before 2.3.0.0.| +|[9](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin9.pdf)|Apache Log4j 1’s JMSSink is vulnerable to insecure deserialization of untrusted logged data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service that the attacker has access to. This may resulting in remote code execution.|[CWE-502](https://cwe.mitre.org/data/definitions/502.html)|[CVE-2022-23302](https://nvd.nist.gov/vuln/detail/CVE-2022-23302)|Remote Code Execution is possible.|None. ESAPI uses ConsoleAppender as the default appender even if ESAPI logging is configured to use Log4J 1.| +|[10](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin10.pdf)|There is an RCE flaw caused by an insecure deserialization vulnerability in Apache Chainsaw, a Java-based GUI log viewer. CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw 2.x prior to 2.1.0. However, prior to Chainsaw V2.0, Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists and remains unfixed.|[CWE-502](https://cwe.mitre.org/data/definitions/502.html)|[CVE-2022-23307](https://nvd.nist.gov/vuln/detail/CVE-2022-23307)|Remote Code Execution is possible if you are running Apache Chainsaw 1.x from the Apache Log4J 1.2.x jar.|None. ESAPI uses ConsoleAppender as the default appender even if ESAPI logging is configured to use Log4J 1.| +|[GHSA-8m5h-hrqm-pxm2](https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-8m5h-hrqm-pxm2)|The default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path.|[CWE-22](https://cwe.mitre.org/data/definitions/22.html)|[CVE-2022-23457](https://nvd.nist.gov/vuln/detail/CVE-2022-23457)|Control-flow bypass may be possible.|ESAPI 2.x, prior to the ESAPI 2.3.0.0 release. Version 2.3.0.0 and later are patched.| +|[11](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin11.pdf)|There is a DoS vulerablity in the FileUploadBase class of Apache Commons FileUpload for releases prior to 1.5. That DoS vulnerability is caused by not limiting the number of files that could be uploaded per single request.|[CWE-770](https://cwe.mitre.org/data/definitions/770.html)|[CVE-2023-24998](https://nvd.nist.gov/vuln/detail/CVE-2023-24998)|None. ESAPI uses a subclass of the affected FileUpladBase abstract class from Apache Commons FileUpload to which a new setFileCountMax() method was added.|Addressed in ESAPI 2.5.2.0 and later.| +|[12](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin12.pdf)
[GHSA-r68h-jhhj-9jvm](https://github.com/ESAPI/esapi-java-legacy/security/advisories/GHSA-r68h-jhhj-9jvm)|Decribes why ESAPI's Validator.isValidSafeHTML is being deprecated and will be removed one year after the ESAPI 2.5.3.0 release date.|[CWE-80](https://cwe.mitre.org/data/definitions/80.html)|N/A (no CVE)|XSS may be possible depending on how the method is used.|All ESAPI versions (all 1.x and 2.x versions). No patch is available until the methods are deleted one year after the ESAPI 2.5.3.0 release date.| +|[13](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin13.pdf)|There is a bypass around ESAPI's Encoder.encodeForSQL interface (a method that always carried a strong warning) that be result in SQL injection vulnerabilities in code that use it.|[CWE-138](https://cwe.mitre.org/data/definitions/138.html)|[CVE-2025-5878](https://www.cve.org/CVERecord?id=CVE-2025-5878)|May leave applications that use Encoder.encodeForSQL vulnerable to SQL injection.|ESAPI 2.x versions before 2.7.0| diff --git a/build.number b/build.number deleted file mode 100644 index a1184af7d..000000000 --- a/build.number +++ /dev/null @@ -1,3 +0,0 @@ -#Build Number for ANT. Do not edit! -#Wed Jul 09 21:13:02 HST 2008 -build.number=68 diff --git a/build.xml b/build.xml deleted file mode 100644 index 3bfdc271b..000000000 --- a/build.xml +++ /dev/null @@ -1,130 +0,0 @@ - -
Welcome to ESAPI
- -The OWASP Enterprise Security API Project may be found at http://www.owasp.org/index.php/ESAPI. This software -is available under the LGPL, and we encourage your participation in the project.
- -ESAPI consists of two key parts, an API defined in a set of interfaces, and a reference implementation of those -interfaces. Within your enterprise, you may want to customize the ESAPI to suit the way you do business. The important -thing is that you work towards creating your ESAPI and getting all of your projects to use it. This will dramatically -increase the likelihood that your developers are producing secure code.
- -Your ESAPI can be viewed as a unified facade to all of your organization's security functionality. Have a clear, easy -to understand API make it easy to find security mechanisms and use them properly. Many of the existing security libraries, -while providing excellent security functions, are much too complex for most developers to use without mistakes. Establishing -your ESAPI will help to prevent this kind of problem.
- -Having an ESAPI has other benefits as well, including:
--
-
- Simplifed requirements -
- Easier developer security training -
- Faster and more reliable security scanning and penetration testing -
- Better results from static analysis and code review -
- Ability to change security mechanisms across applications -
- Higher assurance in your security mechanisms -
- Solid coverage of most of the OWASP Top Ten -
Installation
-To install the ESAPI in your environment, you should include the following jar files on your classpath: -
-
-
- owasp-esapi-1.0.jar -
- commons-fileupload-1.2.jar -
- commons-io-1.3.2.jar -
Newer versions of the Apache Commons projects may also work.
- -Invoking
- -The ESAPI needs to know where to find the ESAPI.properties and other configuration files. This is done by way of a Java system property. -The property should point to the resources directory where the ESAPI files reside. You can specify the system property where you invoke the JVM as follows:
- -java -Dorg.owasp.esapi.resources="/path/to/resources/directory"- -
You can then add calls to the ESAPI methods from your code. For example, to use the ESAPI Validator, you should -get an instance from the singleton with - -
Validator validator = Validator.getInstance()- -Then you can use validation calls directly. For example, to validate an email address, you can use: - -
validation.isValidDataFromBrowser( "Email", input );- -Or - -
-try {
- String validEmail = validation.getValidDataFromBrowser( "Email", input );
-} catch( ValidationException e ) {
- // handle bad data
-}
-
-
-The regular expressions that define validators such as "Email" above are defined in the ESAPI properties file. Note -that the Validator class performs a significant amount of canonicalization work before validating and prevents -many common forms of attack.
- -Configuring
-All of the configuration options for ESAPI are in ESAPI.properties. Generally the values specified there are -good options for a web application that needs to be secure.
- -Building
-ESAPI is set up as an Eclipse project. If you download the full zip archive, you should be able to import it into -Eclipse and get it to compile. You should be able to run the test cases, provided that you remember that your launch -configuration for the test suite will have to have the org.owasp.esapi.resources property defined as described above.
- - - - - - diff --git a/documentation/LoggerDesignAndTesting.md b/documentation/LoggerDesignAndTesting.md new file mode 100644 index 000000000..d3542a48a --- /dev/null +++ b/documentation/LoggerDesignAndTesting.md @@ -0,0 +1,27 @@ +(Gleaned from an email from Jeremiah J. Stacey to Kevin W. Wall on 2021-03-21. Some minor alterations were made for contextual understanding by Kevin Wall because the original email thread was not included.) + +The testing (for SLF4J logging at least) is tested with Mockito and Powermock. For the SLF4J logging, the tests are in Slf4JLoggerTest. It uses mocks to assert that the slf4j logging implementation gets the data we expect in the calls we support. + +I was very deliberate in the breakout of the classes to isolate specific functionality to enable this type of testing. At a high level, there are four classes that make up the logging structure. +I tried to encapsulate a subset of functionality into each one: + +**LogFactory** - Constructs Loggers to be used by clients. Responsible for building the LogBridge and the LevelHandler. + +**Logger** - The ESAPI interface implementation which uses the LogBridge and a delegate Logger to forward events to the underlying log implementation. + +**LogBridge** - Logical handler for determining the delegate handler for a known ESAPI log event, and forwarding the Log event to that handler. Also responsible for prefixing the client/server info content and applying the newline replacement behavior. + +**LogLevelHander** - This is actually where the log event gets sent to SLF4J! The Handler enumeration is assembled as part of a map in the static block of the LogFactory, and is used by the LogBridge to route a log event at a defined ESAPI log level to the correct API of the delegate Logger. + + +The general workflow is: + + LogFactory static block creates the LogPrefixAppender, LogScrubber, and LogBridge. + + LogFactory.getLogger(...) Creates Logger with the delegate slf4j logger implementation and the LogBridge. + + Logger.info/warn/etc(message) -> forwards to LogBridgelog(logger, esapiLevel, type, message) -> forwards to LogHandler.log(...) -> forwards to slf4j Logger implementation with appropriate level and composed message. + +So each of the tests for each of the classes verifies data in -> data out based on the Logging API. The structure for JUL and SLF4J are almost identical. There are a few differences in the interaction with the underlying Logger interactions and expectations. As a result, the tests are also almost full duplications (again accounting for differences in the underlying logging API). + +-J diff --git a/documentation/OWASP ESAPI Overview.html b/documentation/OWASP ESAPI Overview.html deleted file mode 100644 index fdc53babf..000000000 --- a/documentation/OWASP ESAPI Overview.html +++ /dev/null @@ -1,55 +0,0 @@ - - - - - - - -The OWASP Enterprise Security API (ESAPI) is both a set of -interfaces and a reference implementation of a library that provides -enterprise web application developers the most important security -functions they need in order to build web applications and web services -that protect themselves against attacks.
- -The The Open Web Application -Security Project (OWASP) is a worldwide free and open community focused -on improving the security of application software. Our mission is to -make application security "visible," so that people and organizations -can make informed decisions about application security risks. Everyone -is free to participate in OWASP and all of our materials are available -under an open source license. The OWASP Foundation is a 501c3 -not-for-profit charitable organization that ensures the ongoing -availability and support for our work.
- -The OWASP ESAPI Project is led by Jeff Williams, Aspect Security - -
You can find more information about the ESAPI project, or join -the mailing list and help us make it better from the OWASP project page -at http://www.owasp.org/index.php/ESAPI.
- -
-
-The library builds on the excellent security libraries available, -such as Java Logging, JCE, and Adobe Commons FileUpload. It uses the -concepts from many of the security packages out there, such as ACEGI, -Apache Commons Validator, Microsoft's AntiXSS library, and many many -more. This library provides a single consistent interface to security -functions that is intuitive for enterprise developers.
- -
-
-Used properly, the ESAPI provides enough functions to protect -against most of the OWASP Top Ten. The only real exception is the -Insecure Communications category, which is generally outside the control -of the software developer.
- -This project and all associated code is Copyright (c) 2007 - The OWASP Foundation
- -The ESAPI is published by OWASP under the BSD license. You should read and accept the LICENSE -before you use, modify, and/or redistribute this software.
- - - - - - diff --git a/documentation/OWASP ESAPI Overview.pptx b/documentation/OWASP ESAPI Overview.pptx deleted file mode 100644 index 70765374c..000000000 Binary files a/documentation/OWASP ESAPI Overview.pptx and /dev/null differ diff --git a/documentation/OWASP ESAPI Requirements.docx b/documentation/OWASP ESAPI Requirements.docx deleted file mode 100644 index f86bd7b54..000000000 Binary files a/documentation/OWASP ESAPI Requirements.docx and /dev/null differ diff --git a/documentation/cc.JPG b/documentation/cc.JPG new file mode 100644 index 000000000..8ca55b722 Binary files /dev/null and b/documentation/cc.JPG differ diff --git a/documentation/esapi4java-2.0-javadoc-pictures.pptx b/documentation/esapi4java-2.0-javadoc-pictures.pptx new file mode 100644 index 000000000..388fbd906 Binary files /dev/null and b/documentation/esapi4java-2.0-javadoc-pictures.pptx differ diff --git a/documentation/esapi4java-2.0-readme.txt b/documentation/esapi4java-2.0-readme.txt new file mode 100644 index 000000000..7fd25e068 --- /dev/null +++ b/documentation/esapi4java-2.0-readme.txt @@ -0,0 +1,61 @@ + + Welcome to ESAPI for Java! + +(This file best viewed full screen.) + +Here are the most significant directories and files included the zip file for this release: + +File / Directory Description +========================================================================================= +Why Is OWASP Changing ESAPI Encryption?
+Reasons for Change
+Symmetric Encryption in ESAPI 1.4
+The as-delivered, default ESAPI 1.4 +encryption mechanism uses "PBEWithMD5AndDES", a "Password +Based Encryption" algorithm. As implemented in ESAPI 1.4, +password (or pass phrase), taken from the property MasterPassword, is +concatenated with the salt as specified by the property MasterSalt, +and then repeated hashed 20 times using the MD5 message digest +algorithm. The intent of the salt and repetitive hashing is to slow +down dictionary attacks on the password. The result after the 20 +iterations of hashing is used as the DES encryption key. The +encryption uses Cipher Block Chaining (CBC) cipher mode.
+Problems with Symmetric Encryption in ESAPI 1.4
+The problems with symmetric encryption in ESAPI 1.4 are many. Here +are some of the main issues:
+-
+
The implementation only supported a single encryption key. + While this may be sufficient for some uses, clearly there are cases + where multiple recipients are involved when you would like to use + unique encryption keys for each recipient.
+ESAPI 1.4 came with a default setting for MasterPassword and + MasterSalt, thus not requiring that it be changed. How many of you + forgot to change these?
+Password based encryption is likely to be much weaker + randomly choosing a secret key. For instance, if you restrict + yourself to printable ASCII characters (which most people will), it + would require a pass phrase of roughly 45 characters to be the + equivalent of a randomly chosen 128-bit secret key.
+The default algorithm, DES, only has an effective key length + of 56-bits. This key size is too short and is in the realm of brute + forcing within a short amount of time for most medium to large + companies. (Fortunately, this could be addressed in part by changing + the EncryptionAlgorithm property from "PBEWithMD5AndDES" + to either "PBEWithHmacSHA1AndDESede" [if you are using JDK + 1.5 or later] or to "PBEWithMD5AndTripleDES" [if you are + still using JDK 1.4]. Unfortunately, because of the implementation + of
+JavaEncryptor, only "password based encryption" + algorithms can be used in ESAPI 1.4.)The symmetric encryption does not provide for any means of + confirming message authenticity. Cryptographers consider ensuring + message authenticity an important feature of modern cryptosystems.
+
Symmetric Encryption in ESAPI 2.0rc1 and 2.0rc2
+By default, release candidates ESAPI
+2.0-rc1 and 2.0-rc2 used the 256-bit AES cipher with the cipher mode
+Electronic Code Book (ECB) for encryption with Encryptor
+via the ESAPI reference implementation, JavaEncryptor.
+ECB cipher mode is the simplest cipher mode to use, but it is also
+cryptographically very weak. If more than one block of plaintext is
+encrypted with the same key, those identical blocks of ciphertext
+always encrypt to the same ciphertext block, thus revealing patterns
+in the plaintext input. For example, these images from Wikipedia's
+Block
+cipher modes of operation illustrate this point well:
+
|
+
|
+
+
|
+
+
|
+
|
+ Original Tux image + |
+
+ Image encrypted using ECB mode + |
+
+ Image encrypted using modes other than ECB + |
+
Ciphertext encrypted with ECB cipher mode are also subject to +"block replay attacks". See Bruce Schneier's Applied +Cryptography: protocols, algorithms, and source code for +details. +
+In both ESAPI 2.0-rc1 and 2.0-rc2, one can choose other block +ciphers (e.g. Blowfish) or other key sizes (e.g., 512-bit AES), but +encryption in ESAPI 2.0-rc1 and 2.0-rc2 only support ECB +cipher mode with no padding; it cannot be used to decrypt data +encrypted with anything other than an algorithm using ECB cipher mode +and no padding. Most encryption (outside of ESAPI) uses some other +cipher mode (e.g., Cipher Block Chaining (CBC) mode) and some sort of +padding scheme, such as PKCS#5 padding, meaning that they are many +situations where ESAPI encryption would not be suitable.
+Problems with Symmetric Encryption in ESAPI 2.0-rc1 and 2.0-rc2
+The problems with symmetric encryption in ESAPI 2.0-rc1 and 2.0rc2 +are many. Here are some of the main issues:
+-
+
The implementation only supported a single encryption + key. While this may be sufficient for some uses, clearly there are + cases where multiple recipients are involved when you would like to + use unique encryption keys for each recipient.
+ESAPI 2.0-rc1 and 2.0-rc2 came with a default settings for + Encryptor.MasterKey and Encryptor.MasterSalt, thus not requiring + that these be changed. How many of you forgot to change these?
+Because the reference implementation in
+JavaEncryptor+ allows no means to specify an Initialization Vector (IV), only the + weak ECB cipher mode can be used.The symmetric encryption does not provide for any means of + confirming message authenticity. Cryptographers consider ensuring + message authenticity an important feature of modern cryptosystems.
+
The Encryption Changes in ESAPI 2.0-rc3 and Later
+Briefly speaking, the changes being implemented for ESAPI Java 2.0 +are: +
+-
+
Starting in ESAPI Java 2.0-rc3, + the default cipher transformation is changing to + "AES-128/CBC/PKCS5Padding" (i.e., 128-bit AES in CBC + cipher mode and PKCS#5 padding) with a random IV. The main reason + that 128-bit AES was chosen over 256-bit AES for the default is that + 128-bit AES is slightly faster than 256-bit AES, and it does not + require you downloading the Unlimited Strength Jurisdiction Policy + files from Sun Microsystems. For those believing that 128-bit AES is + not sufficiently strong--bruting forcing it (except perhaps with a + reasonable quantum computer) is still not feasible--and certain key + related attacks (see Biryukov, Dunkelman, Keller, Khovratovich, and + Shamir's Cryptology ePrint + Archive: Report 2009/374 -- Key Recovery Attacks of Practical + Complexity on AES Variants With Up To 10 Rounds for further + details) show that longer key sizes in AES may not always be the + best.
+Because cipher modes other than + ECB require an Initialization Vector (IV), a mechanism to handle + both fixed and random IVs has been added. The use of the “fixed” + IV should only be considered if there is a need to be compatible + with some legacy software or third party software package. Those + cases should be rare.
+The original attempt to preserve + backward compatibility with ESAPI Java 1.4 (via +
+org.owasp.esapi.reference.crypto.LegacyJavaEncryptor) + has been removed. This was put to a vote on Jan 31, 2010 before both + the ESAPI Users and ESAPI Developers mailing lists and the lack of + response was deafening. There literally was but a single response + and that was to kill offLegacyJavaEncryptor.+ (By this time, the two symmetric encryption interfaces inEncryptor+ had already been deprecated.) +The byte-encoding has been changed from native byte encoding + to UTF-8 byte-encoding throughout ESAPI 2.0 and not just for + encryption. This was needed so that one could (say) encrypt on a + Sparc running Solaris and then move the encrypted data to an Intel + host running Windows and still be able to decrypt the data. Without + this change to use uniform encoding throughout, this could not be + guaranteed.
+
The Good, the Bad, and the Ugly
+Or put another way, there are always trade-offs to be made... +
+The Good
+We get improved security by encouraging the use of stronger cipher +modes (and ESAPI is all about "enterprise security", +right?). Furthermore, it is possible to choose a preferred JCE +provider for ESAPI and ESAPI will attempt to use that provider. For +example, if you wish to use Bouncy Castle rather than the SunJCE, you +can do so. One place where this might be a significant advantage is +if you need to use a FIPS 140-2 compliant JCE implementation. Whereas +in production environments, you ultimately will want to ensure this +by editing your $JAVA_HOME/jre/lib/security/java.security +file, this is often inconvenient for developers who simply wish to +test because this file often requires super-user access to alter. In +such cases, setting the new ESAPI property +Encryptor.PreferredJCEProvider +to the fully qualified class name of your FIPS 140-2 JCE provider in +your ESAPI.properties +file and you can test without any other changes to your code or you +environment.
+We also get message authenticity as long as we don't use any of +the deprecated encryption methods or intentionally disable it. (The +only sane reason for intentionally disabling the MAC +calculation is for FIPS 140-2 compliance. This MAC calculation +requires deriving two new SecretKeys +from the original key—one to use for message authenticity and a +second one to use for message confidentiality. While we believe that +this mechanism is secure [it was originally suggested by professional +cryptographers], this key derivation would not be using FIPS 140-2 +approved code. Therefore if you require FIPS 140-2 compliance, you +should set “Encryptor.CipherText.useMAC=false” +in your ESAPI.properties +file.)
+The Bad
+With cipher modes that require an IV, the same IV must be used +both to encrypt and decrypt. While it is not required that the IV be +kept secret from adversaries, there are some attacks that are +possible if the adversary is permitted to alter the IV at will and +observe the results of the ensuing decryption attempt. +
+So that leaves two choices for the IV: +
+-
+
Using a fixed IV: + The IV can be agreed upon out-of-band by the parties exchanging + encrypted messages. In this way, the encrypted data that is stored + and/or transmitted can be limited to only the raw ciphertext. + (WARNING: + This case should be reserved for situations requiring compatibility + with legacy or third party software packages.)
+Using a random IV: Most cryptographers prefer + to use a random IV, typically a different one with each message to + be encrypted. However, doing so on encrypted data that will be + persisted (e.g., to a database) or transmitted to the recipient this + random IV must be stored / made known. Therefore, the raw ciphertext + can no longer suffice; whatever random IV that was chosen must be + communicated. +
+
Likewise, the use of padding is going to add some overhead to the +length of the ciphertext.
+For example, a short plaintext of 0-15 +bytes, this overhead can be around 200% of the total plaintext size. +This overhead diminishes (as a percent of the total plaintext size) +as the plaintext size increases. Here is a table that illustrates +this:
+ +
+
|
+ Original input length of plaintext |
+
+ Base64-encoded length of ciphertext (with IV + and padding) encrypted with 128-bit AES in CBC mode, but no MAC1 + |
+
+ Length of raw portable serialized CipherText + byte array, containing IV, padding, and MAC, and encrypted with + 128-bit AES in CBC mode + |
+
+ Length of raw portable serialized CipherText, + containing IV, padding, and MAC, and encrypted with 128-bit AES in + CBC mode as a Base64-encoded string + |
+
|
+ 0-15 + |
+
+ 44 + |
+
+ 102 + |
+
+ 137 + |
+
|
+ 16-31 + |
+
+ 64 + |
+
+ 118 + |
+
+ 162 + |
+
|
+ 32-47 + |
+
+ 88 + |
+
+ 134 + |
+
+ 182 + |
+
|
+ 48-63 + |
+
+ 108 + |
+
+ 150 + |
+
+ 202 + |
+
|
+ 64-79 + |
+
+ 128 + |
+
+ 166 + |
+
+ 222 + |
+
|
+ … etc. Each additional 16 bytes of plaintext... + |
+
+ ...adds ~20 additional bytes + |
+
+ ...adds 16 additional bytes + |
+
+ ...adds 20 additional bytes + |
+
__________________________________
+1. That is, the String +that is returned by the deprecated Encryptor.decrypt(String) +method.
+As you can see, since the size of the IV and the amount of padding +bytes are fixed at a maximum, this overhead goes down as the length +of the plaintext message increases. The IV is always a fixed length +for a given cipher; it is always the same as the cipher block size. +The padding can vary, but for PKCS5 padding, the padding will be +between 1 to the cipher block size (in bits) / 8 bytes. For AES, the +cipher block size is 128-bits, but more typically, a cipher's block +size is 64-bits so the padding would be between 1 to 16 bytes for AES +and 1 to 8 bytes for a 64-bit block size cipher and the IV would be +IV would be 16 bytes for AES and 8 bytes for most other ciphers. +
+The Ugly
+Well, so far, this "bad" news may be bad for you but +good for your database and/or storage vendor, but you probably can +live with it, especially if you are willing to do a little bit of +recoding of your database table sizes.
+But wait Skippy, don't go running off just quite yet. As Robert +Heinlein wrote in his 1966 novel The Moon is a Harsh Mistress +"There ain't no such thing as a free lunch". (Some of us +more hardened cynics know it more commonly as TANSTAAFL.) +
+As mentioned earlier, backward compatibility with ESAPI 1.4
+(originally planned via LegacyJavaEncryptor) has been
+removed because of apparent lack of interest. What this means is if
+you are one of the unlucky stuckeys who are using ESAPI 1.4 symmetric
+encryption to encrypt data and you have persisted this data (and this
+would include the use of the
+org.owasp.esapi.EncryptedProperties
+class in ESAPI 1.4), you will
+first have to decrypt this
+encrypted data using ESAPI 1.4 before using encryption with ESAPI
+2.0. As they say, “we are sorry for the inconvenience”, but there
+was an opportunity to make your voice heard so we refuse to take all
+the blame.
In addition, all this backward compatibility and flexibility comes
+at the extra cost of complexity, and not merely additional
+complexity in the reference implementation. There is also some
+additional complexity in the ESAPI Encryptor interfaces
+as well.
In particular, there new classes for plaintext (PlainText)
+and ciphertext (CipherText) class to coalesce all this
+complexity of handling the ciphertext result from encryption
+operations. And then there are new encryption and decryption methods
+for the Encryptor interface. Specifically, the encrypt
+and decrypt methods have been generalized as:
+
CipherText encrypt(SecretKey key, PlainText plaintext) + throws EncryptionException;
+and +
+PlainText decrypt(SecretKey key, CipherText ciphertext) + throws EncryptionException
+(There are also two corresponding encrypt / decrypt methods that omit +the initial SecretKey +argument and instead use the SecretKey +based on Encryptor.MasterKey.)
+The two existing interfaces from ESAPI 1.4 and earlier:
+String encrypt(String plaintext) throws EncryptionException
+and +
+String decrypt(String ciphertext) throws EncryptionException
+are still supported but have been deprecated, mainly because +they do not support integrity / authenticity checks which most +cryptographers consider essential. Also these older String-based +encrypt() / decrypt() interfaces have slightly different semantics +than do their ESAPI 1.4 counterparts in that these methods default to +CBC cipher mode, PKCS5Padding, and a random IV. This means that at a +minimum, the IV must be included as the resulting base64-encoded +“ciphertext”.
+However, this difference in cipher mode means that if you have +data that was previously encrypted using ESAPI 1.4 or earlier, you +will not be able to decrypt it using the ESAPI 2.0
+String decrypt(String ciphertext) throws EncryptionException
+method. If you require such compatibility, you may contact the +author, Kevin W. Wall, +for assistance. +
+Note that while the new String-based encrypt() / decrypt() methods +use the stronger CBC cipher mode with a random IV, they still do not +ensure authenticity and integrity so the more general encrypt() / +decrypt() methods should be preferred over the String-based ones. +(See below for examples of how to use these new methods.)
+Further Details
+Further details are provided in the Encryptor Javadoc
+and the “Symmetric Encryption” section of the ESAPI User Guide.
| + + Crypto song: Take a listen and enjoy! Harry Belafonte never sounded this good. ;-) + + | +
ESAPI 2.0 Symmetric Encryption User Guide
+ESAPI.properties Properties Relevant to Symmetric Encryption
+Those properties that are new since ESAPI 2.0-rc2 are shown in +red. Values shown in blue +are ones that you would replace.
+|
+ Property Name + |
+
+ Default Value + |
+
+ Comment + |
+
|---|---|---|
+ ESAPI.Encryptor+ |
+
+ org.owasp.esapi.reference.crypto.JavaEncryptor+ |
+
+ The class implementing the Encryptor interface and + returned by ESAPI.encryptor(). + |
+
+ Encryptor.MasterKey+ |
+
+ <initially unset> + |
+
+ The base64-encoded SecretKey. The key must be + appropriate to the specified key size and cipher algorithm. +Set as per the instructions in the ESAPI + Installation Guide. + |
+
+ Encryptor.MasterSalt+ |
+
+ <initially unset> + |
+
+ A base64-encoded random “salt”. This should be + at least 20-bytes. It is used to generate a random (but + consistent) public/private key pair used in asymmetric encryption + and digital signatures. +Set as per the instructions in the ESAPI + Installation Guide. + |
+
+ + |
+
+ AES+ |
+
+ A deprecated property, superseded by + Encryptor.CipherTransformation. + |
+
+ Encryptor.CipherTransformation+ |
+
+ AES/CBC/PKCS5Padding+ |
+
+ Specifies the cipher transformation to use for + symmetric encryption. The format is + cipherAlgorithm/cipherMode/paddingScheme. + |
+
+ Encryptor.EncryptionKeyLength+ |
+
+ 128+ |
+
+ Default key size, in bits. Required for cipher algorithms + that support multiple key sizes. + |
+
+ Encryptor.MinEncryptionKeyLength+ |
+
+ 128+ |
+
+ Minimum key size, in bits, that ESAPI will support + for encryption. (Note that any legitimate size is + accepted for decryption.) So, for example, if you needed + to be able to do encryption for 2-key Triple DES (aka, 2TDEA), + then you would have to change this to '112'. Note that for a + minimum key size of larger than 128-bits, you will need + to have the JCE Unlimited Strength Jurisdiction Policy files + installed on your runtime system. + + |
+
+ Encryptor.ChooseIVMethod+ |
+
+ random+ |
+
+ Legal values are “random” or “fixed”.
+ Random is recommended. Set to “fixed” only if required for
+ compatibility with legacy or third party software. If set to
+ “fixed”, then the property Encryptor.fixedIV must also be
+ set to hex-encoded specific IV that you need to use.
+ NOTE: "fixed" had been deprecated since 2.2.0.0 and finally
+ was removed for release 2.3.0.0. Using it in versions 2.3.0.0 or
+ later will result in a + CAUTION: While it is not required that the IV be kept + secret, encryption relying on fixed IVs can lead to a known + plaintext attack called a "Key Collision Attack". While this + attack is probably not practical (for those with modest + resources) for ciphers with 128-bit key size, this attack + makes it possible to capture the ciphertexts from only + 2(N/2) known plaintexts to discover the + encryption key. Loughran and Dowling explain a Java + implementation of Eli Biham's key collision attack on DES in + their easy to understand paper, + + A Java Implemented Key Collision Attack on the + Data Encryption Standard (DES). Since attacks only get + better and the cost of storage is dropping rapidly, you are + urged to avoid using "fixed" IVs except when required for + backward compatibility. In particular, should never use + fixed IVs just to avoid the storage cost of storing a random + IV. + + |
+
+ Encryptor.fixedIV+ |
+
+ 0x000102030405060708090a0b0c0d0e0f+ |
+
+ A hex-encoded value to use as a fixed IV. Only
+ used if the property Encryptor.fixedIV is set to “fixed”. Intended
+ only for compatibility with legacy code. See the above
+ related above caution for |
+
+ Encryptor.CipherText.useMAC+ |
+
+ true+ |
+
+ Whether or not Note: If the cipher mode used is one specified in
+ the comma-separated list of cipher modes given in the property
+ Encryptor.cipher_modes.combined_modes, then a separate MAC
+ is not calculated for |
+
+ Encryptor.PreferredJCEProvider+ |
+
+ <empty string>+ |
+
+ Specifies the preferred JCE provider, that
+ is the JCE provider that is first looked at for JCE algorithms.
+ The |
+
+ Encryptor.cipher_modes.additional_allowed+ |
+
+ CBC+ |
+
+ Additional cipher modes allowed for ESAPI 2.0 + symmetric encryption. These cipher modes are in addition to + those specified by the property + Encryptor.cipher_modes.combined_modes. +Note: We will add support for streaming modes like + CFB & OFB once we add support for 'specified' to the property + Encryptor.ChooseIVMethod (probably in ESAPI 2.1). + |
+
+ Encryptor.cipher_modes.combined_modes+ |
+
+ GCM,CCM,IAPM,EAX,OCB,CWC+ |
+
+ Comma-separated list of cipher modes that provide
+ both confidentiality and
+ message authenticity. (NIST refers to such cipher
+ modes as "combined modes" so that's what we
+ shall call them.) If any of these cipher modes are used then no
+ MAC is calculated and stored in the Note that as of JDK 1.5, the SunJCE provider does + not support any of these cipher modes. Of these listed, + only GCM and CCM are currently NIST approved. + |
+
+ Encryptor.PlainText.overwrite+ |
+
+ TRUE+ |
+
+ Whether or not the plaintext bytes for the + PlainText object may be overwritten with “*” characters and + then marked eligible for garbage collection. If not set, this is + still treated as 'true'. If this is set to 'true', you will not be + able to use any PlainText object after you have used it with one + of the Encryptor encrypt() methods. + |
+
+ Encryptor.KDF.PDF+ |
+
+ HmacSHA256+ |
+
+
+ This is the Pseudo Random Function (PRF) that ESAPI's Key
+ Derivation Function (KDF) normally uses. NSA wanted us to
+ support something stronger than HmacSHA1 (even though that
+ is considered fine for now--unless perhaps you are guarding
+ nuclear launch codes--and if so, your Java license probably
+ prohibits that ;-).
+ |
+
+ Encryptor.CharacterEncoding+ |
+
+ UTF-8+ |
+
+ The default encoding used for certain aspects such + as signing and sealing. + |
+
How the Old (Deprecated) Methods Were Used
+To encrypt / decrypt using the String-based, deprecated methods +carried over from ESAPI 1.4, code similar to the following would be +used. +
+ String myplaintext = "My plaintext";
+ try {
+ String ciphertext = ESAPI.encryptor().encrypt(myplaintext);
+ String decrypted = ESAPI.encryptor().decrypt(ciphertext);
+ assert decrypted.equals(myplaintext);
+ } catch(EncryptionException ex) {
+ // Log error then return error designation however appropriate
+ }
+This code will still work, however if you are using the standard
+(default) reference for ESAPI.Encryptor, which is
+org.owasp.esapi.reference.crypto.JavaEncryptor, the
+cipher transformation used with be that specified by the property
+Encryptor.CipherTransformation with a key size (when the
+algorithm supports a variable key size) of that specified by
+Encryptor.EncryptionKeyLength and the IV type specified
+by Encryptor.ChooseIVMethod. What is not provided by
+these methods (and why they are deprecated) is that they provide no
+mechanism to ensure message authenticity unless they are used with a
+so-called “combined” cipher mode such as CCM or GCM. (Note
+that as of JDK 1.6, the default JCE provider, “SunJCE”, does not
+support any combined cipher modes.)
Requirements for using ESAPI Symmetric Encryption
++The parties participating in using ESAPI's symmetric encryption +capabilities must agree on the following: +
-
+
- +All parties must share the same encryption key(s). If multiple keys are +used, each party must know which key to use for encryption / decryption. +Parties must ensure that exchanging, storing, and all management +of these encryption keys is done securely. How this is done is +presently outside the scope of ESAPI encryptions, but developers may +find the advice in + +OWASP's Cryptographic Storage Cheat Sheet helpful in this regard. + +
- +If parties are only exchanging raw ciphertext (plus IV, when appropriate), +then they must also agree on the cipher transformation to use. + +
- +If the involved parties participating in encryption are not using a +"combined" cipher mode that provides both confidentiality and authenticity +(for example, something like GCM or CCM), then they must whether or +not there will be an additional MAC sent allow with the raw ciphertext and +other cipher spec information in order to provide evidence of authenticity / +data integrity. (See the property Encryptor.CipherText.useMAC +for further details.) Failure to agree on this may allow an adversary to +carry out certain chosen ciphertext attacks against their encrypted data +resulting in (possibly complete) leakage of the corresponding plaintext. + +
Encrypting / Decrypting with the New Methods -- The Simple Usage
+Using the new encryption / decryption methods is somewhat more +complicated, but this is in part because they are more flexible and +that flexibility means that more information needs to be communicated +as to the details of the encryption. +
+A code snippet using the new methods that use the master +encryption key would look something like this: +
+ String myplaintext = "My plaintext";
+ try {
+ CipherText ciphertext =
+ ESAPI.encryptor().encrypt( new PlainText(myplaintext) );
+ PlainText recoveredPlaintext = ESAPI.encryptor().decrypt(ciphertext) );
+ assert myplaintext.equals( recoveredPlaintext.toString() );
+ } catch(EncryptionException ex) {
+ // Log error then return error designation however appropriate.
+ }+Yes, this is a bit more complicated, but it will 1) work across +different hardware platforms and operating systems whereas the older +methods may not, and 2) it provides for authenticity and +confidentiality of the ciphertext regardless of which cipher +mode is chosen.
+Also, these new methods allow a general byte array to be +encrypted, not just a Java String. If one needed to encrypt a byte +array with the old deprecated method, one would first have to use +
+ byte[] plaintextByteArray = { /* byte array to be encrypted */ };
+ String plaintext = new String(plaintextByteArray, "UTF-8");
+all the while catching the required UnsupportedEncodingException.
+For example, to handle this in ESAPI 1.4, one would have to write
+something like:
+ try {
+ byte[] plaintextByteArray = { /* byte array to be encrypted */ };
+ String myplaintext = new String(plaintextByteArray, "UTF-8");
+ String ciphertext = ESAPI.encryptor().encrypt(myplaintext);
+ String decrypted = ESAPI.encryptor().decrypt(ciphertext);
+ byte[] recoveredBytes = decrypted.getBytes(“UFT-8”);
+ assert java.util.Arrays.equals( plaintextByteArray, recoveredBytes );
+ } catch( UnsupportedEncodingException ex) {
+ // Should not happen but need to catch and deal with it anyhow.
+ // Log error then return error designation however appropriate.
+ } catch(EncryptionException ex) {
+ // Log error then return error designation however appropriate.
+ }
++However, dealing with this in ESAPI 2.0 is not any more cumbersome +than dealing with Strings:
+
+ try {
+ byte[] plaintextByteArray = { /* byte array to be encrypted */ };
+ CipherText ciphertext =
+ ESAPI.encryptor().encrypt( new PlainText(plaintextByteArray) );
+ PlainText recoveredPlaintext = ESAPI.encryptor().decrypt(ciphertext) );
+
+ assert java.util.Arrays.equals( plaintextByteArray,
+ recoveredPlaintext.asBytes() );
+ } catch(EncryptionException ex) {
+ // Log error then return error designation however appropriate.
+ }
+
+Ideally when you are encrypting sensitive data you do not want the
+plaintext sensitive data to be left lying around after it is
+encrypted. Instead, you should overwrite them after their value as
+been used. However, when you are using immutable Strings, this is not
+possible using native Java methods. But if you are able to pass in
+byte arrays that are passed directly to PlainText
+objects (as shown above), the default is to overwrite this
+after they are encrypted.
+
+(Note: Verify!) If the default for
+Encryptor.PlainText.overwrite
+of true
+had been used, then the array plaintextByteArray
+would have been overwritten with ASCII “*” characters.
Encrypting / Decrypting with the New Methods – Storing Encrypted Data
+If you use one of the new
+Encryptor encrypt() / decrypt() methods, how do you persist the
+CipherText object returned by the encrypt() methods and how do
+you restore it to pass to the decrypt() method?
The following example code
+snippet will illustrate this. In the following example we will simply
+write out the serialized CipherText object to a local file, but
+obviously you could hex- or base64-encode the serialized byte array
+and store it in a database or sent it in a SOAP XML message to a web
+service, etc.
public class PersistedEncryptedData
+ {
+ public static int persistEncryptedData(PlainText plaintext,
+ String filename)
+ throws EncryptionException, IOException
+ {
+ File serializedFile = new File(filename);
+ serializedFile.delete(); // Delete any old serialized file.
+
+ CipherText ct = ESAPI.encryptor().encrypt(plaintext);
+ byte[] serializedCiphertext = ct.asPortableSerializedByteArray();
+
+ FileOutputStream fos = new FileOutputStream(serializedFile);
+ fos.write(serializedCiphertext);
+ fos.close();
+ return serializedCiphertext.length;
+ }
+
+ public static PlainText restorePlaintext(String encryptedDataFilename)
+ throws EncryptionException, IOException
+ {
+ File serializedFile = new File(encryptedDataFilename);
+ FileInputStream fis = new FileInputStream(serializedFile);
+ int avail = fis.available();
+ byte[] bytes = new byte[avail];
+ fis.read(bytes, 0, avail);
+
+ CipherText restoredCipherText =
+ CipherText.fromPortableSerializedBytes(bytes);
+ fis.close();
+ PlainText plaintext = ESAPI.encryptor().decrypt(restoredCipherText);
+ return plaintext;
+ }
+ }
+
+Advanced Usage
+Encrypting / Decrypting with the New Methods
+ESAPI 1.4 and earlier only allowed you to use the master key
+(MasterPassword in
+ESAPI 1.4; Encryptor.MasterKey in ESAPI 2.0) to encrypt
+and decrypt with. But encryption with a single key seldom is
+sufficient. For instance, lets say that your application has a need
+to encrypt both bank account numbers and credit card numbers. The
+encrypted bank account numbers are to be sent to one recipient and
+the encrypted credit card numbers are to be sent to a different
+recipient. Obviously in such cases, you do not want to share the same
+key for both recipients.
+
In ESAPI 1.4 there was not much you can do, but in ESAPI 2.0 and
+later, there are new encryption / decryption methods that allow you
+to specify a specific SecretKey. There is also a static
+helper method in CryptoHelper to allow you to generate a
+SecretKey of a specific type. (Distribution of this key
+is out of scope for this particular example, but for the moment, we
+will assume that secret keys are first generated, and then
+distributed to the recipients out-of-band. On you could distribute
+them dynamically via asymmetric encryption assuming that you've
+previously exchanged public keys with the recipients.)
The following illustrates how these new methods might be used. +
+First, we would generate some appropriate secret keys and +distribute them securely (e.g., perhaps over SSL/TLS) or exchange +them earlier out-of-band to the intended recipients. (E.g., one could +put them on two separate thumb drives and use a trusted courier to +distribute them to the recipients or one could use PGP-mail or S/MIME +to securely email them, etc.) +
+ // Generate two random, 128-bit AES keys to be distributed out-of-band.
+ import javax.crypto.SecretKey;
+ import org.owasp.esapi.crypto.CryptoHelper;
+ import org.owasp.esapi.codecs.Hex;
+
+ public class MySecretKeys {
+ public void main(String[] args) {
+ try {
+ SecretKey bankAcctKey = CryptoHelper.generateSecretKey("AES", 128);
+ SecretKey credCardKey = CryptoHelper.generateSecretKey("AES", 128);
+
+ System.out.println("Bank account key: " +
+ Hex.encode( bankAcctKey.getEncoding(), true ) );
+ System.out.println("Credit card key: " +
+ Hex.encode( credCardKey.getEncoding(), true ) );
+ } catch(Exception ex) {
+ ex.printStackTrace(System.err);
+ System.exit(1);
+ }
+ System.exit(0);
+ }
+ }
+Second, these keys would be printed out and stored somewhere secure
+by our application, perhaps using something like ESAPI's
+EncryptedProperties class, where they could later be
+retrieved and used.
+
In the following code, we assume that the SecretKey
+values have already been initialized elsewhere.
+
SecretKey bankAcctKey = ...; // These might be read from EncryptedProperties
+ SecretKey credCardKey = ...; // or from a restricted database, etc.
+ ...
+ String bankAccountNumber = ...; // Assume obtained elsewhere
+ String creditCardNumber = ...; // Ditto
+ ...
+ try {
+ // Encrypt each with their appropriate secret key
+ CipherText encryptedBankAcct =
+ ESAPI.encryptor().encrypt( bankAcctKey, new PlainText(bankAccountNumber) );
+ CipherText encryptedCreditCard =
+ ESAPI.encryptor().encrypt( credCardKey, new PlainText(creditCardNumber) );
+ ...
+ // Decrypt using appropriate secret key
+ PlainText recoveredBankAcct = ESAPI.encryptor().decrypt( bankAcctKey, encryptedBankAcct ) );
+ assert bankAccountNumber.equals( recoveredBankAcct );
+ ... etc. ...
+ } catch(EncryptionException ex) {
+ // Log error then return error designation however appropriate.
+ }
+Using ESAPI with Multiple Cipher Transformations
+For the most part, the architecture of ESAPI assumes that you will +stick to using the defaults in the ESAPI.properties configuration +file or implment your own classes--possibly by extending the ESAPI +reference classes--and use these classes instead of the reference +classes. ++For most things, this works well. Most applications likely can +standardize on a single cipher transformation such as AES/CBC/PKCS5Padding +with a 128-bit AES key and use that 100% of the time. However, on +occassion, an application may need to use two separate cipher +transformations (or even two different cipher algorithms) to +handle legacy applications or deal with multiple partners. +
+This section discusses how to do this without implementing your own
+classes or extending the ESAPI reference class, JavaEncryptor.
+Note that it is recognized that this approach is somewhat of a kludge.
+A simpler approach is planned for ESAPI 2.1, but the approach shown
+here is workable even though it's not pretty.
+
+If you find yourself in need of encrypting with a different cipher
+transformation, the first thing that you should count on is not
+using the same encryption key for each. While in some cases this
+likely would work (e.g., you are only using a different cipher mode
+or you have 256-bit AES key for "Encryptor.MasterKey" but also have
+a need to do encryption with a 128-bit AES key), it is not guaranteed
+to do so. Instead, you should count on generating a separate encryption
+key and using the encrypt / decrypt methods taking an additional
+SecretKey parameter as show in the previous section.
+
+Rather than repeating all the details of how to do this in this
+user guide, we encourage you to investigate how this was done in
+the Junit testing for the JavaEncryptor class. Please
+look at the source code for the private method
+runNewEncryptDecryptTestCase(String, int, byte[]) in
+the EncryptorTest JUnit test in the source code
+"src/test/java/org/owasp/esapi/reference/crypto/EncryptorTest.java".
+This code calls:
+
+ ESAPI.securityConfiguration().setCipherTransformation(cipherXform); ++which sets ESAPI to use the specified cipher transformation, +
cipherXform. As a convenience (for later restoral),
+it returns the previous cipher transformation.
+
+There are also a few non-obvious key size adjustments that are also
+going on with DES and DESede (aka, triple DES) keys that are made there
+as well. This has to do with the fact that for DES keys (which
+includes DESede), the "true" key size differs from the "effective"
+key size. (E.g., in DES, the "true" key size--from the DES algorithms's
+perspective is 64-bits, however the effective key size for DES
+is only 56-bits because of the 8-bits of parity "imposed" by the NSA in
+the early 1970s.) This inconsistency manifests itself in the JCE by
+the fact that KeyGenerator.init() wants the effective
+key size to be specified (so 56-bits for DES, 112- or 168-bits for
+DESede), but SecretKey.getEncoding().length stores the
+"true" key size (e.g., 64-bits or 192-bits for DES and DESede respectively).
+Other cipher algorithms do not have this discrepancy between true and
+effective key sizes. Since a SecretKey is returned by the
+KeyGenerator, this is only all too confusing. The
+reference JavaEncryptor and its JUnit test,
+EncryptorTest attempt to deal with this discrepency.
+See the adjustments made to key size in
+EncryptorTest.runNewEncryptDecryptTestCase()
+for further details.
+
Using ESAPI Symmetric Encryption with FIPS 140-2 Cryptographic Modules
+If you wish to use ESAPI with a FIPS 140-2 validated, JCE-compliant +cryptographic module such as the + +IBM Java JCE FIPS 140-2 Cryptographic Module +(hereafter referred to as IBMJCEFIPS) or the + +RSA Security BSafe Crypto-J +(hereafter referred to as Crypto-J), or other similar products, you +must follow these instructions. Failure to do so will mean that +you will fail to meet FISMA compliance. (Note: The mention of these +two specific vendor products does not constitute an endorsement from +either OWASP or this author.) ++
-
+
- Follow the vendor's regular instructions to configure your application
+to use the vendor product in a FIPS 140-2 compliant manner. Generally this
+will include some special configuration and/or initialization requirements
+that must be followed to restrict the vendor software to use FIPS 140-2
+approved algorithms.
+
+If the vendor's instructions do not already include a recommendation to edit +the$JAVA_HOME/jre/lib/security/java.securityfile, the OWASP +team recommends that you do so to prevent you from accidentally using any +other cryptographic module (such as SunJCE). To do this, you will need +to change the property "security.provider.1" (which represents the default) +provider so that it refers to the fully-qualified classname of +your vendor's JCEProviderclass. (By default, this is set to +"sun.security.provider.Sun".) In fact, you may wish to go as far as to +either comment out or remove the other providers to reduce the possibility +that they will accidentally be used by your application. +
+ - Edit the ESAPI.properties that your application is going to
+be using and set the property "Encryptor.PreferredJCEProvider" to
+the fully qualified classname of your vendor's FIPS 140-2 compliant
+JCE provider class. (If you are using a Java
SecurityManager+you may also need to grant +org.owasp.esapi.reference.crypto.JavaEncryptorpermissions +to change the JCE provider.) +
+ - Edit the ESAPI.properties that your application is going to
+be using and set the property Encryptor.CipherText.useMAC to
+
false. This is critical as having this property +set totruecauses ESAPI to use derived keys +for the actual encryption and MAC calculation, which is against FIPS 140-2 +compliance. (Note: This +does not mean that OWASP believes that this key derivation is weak--its +design has been suggested some cryptographers--but it would be creating and +using a related key for encryption in a manner not reviewed by NIST +and thus it is not acceptable to FIPS 140-2 approval.) +
+ - Edit the ESAPI.properties that your application is going to
+be using and set the property "Encryptor.CipherTransformation" to
+a cipher transformation that is FIPS 140-2 certified for you vendor's
+software. OWASP recommends using a NIST "combined" cipher mode, that is
+one that provides for both message confidentiality and message
+authenticity if such a cipher mode is available from your vendor
+and FIPS 140-2 certified. (Cipher modes "GCM" and "CCM" are the only
+FIPS 140-2 approved as of this writing.)
+If such a "combined" cipher mode is not available, then use a cipher
+transformation like "AES/CBC/PKCS5Padding" with a random IV.
+This is almost always available as one of the FIPS 140-2 certified cipher
+transformations, however it will not provide you with message authenticity
+because to remain FIPS 140-2 compliant you will have had to disable the
+MAC calculation (via setting Encryptor.CipherText.useMAC to
+
false) causing ESAPI to skip calculating an +explicit MAC for you and hence providing no assurance of data integrity +to the party attempting to decrypt your data. Without authenticity +however, your encryption may still be vulnerable to the "padded oracle" +chose ciphertext attack. Consult with your local cryptographic expert in +such cases as this depends greatly on the circumstances of how you are +using encryption. +
+ -
+If your vendor softare requires you to explicitly to initialize their
+software for FIPS-mode (e.g., to cause the required FIPS 140-2 "power-on
+self tests" to run) by calling some software method, then this must be
+done by your application code before calling any of the ESAPI
+crypto-related code. Specifically, it must be called before
+your application calls
ESAPI.encryptor(). +
+
+We believe that following these steps will still allow for your application +to be FIPS 140-2 / FISMA compliant, however, as always, you should check +with your FIPS auditor before using ESAPI in this manner. Should your +auditors ask, feel free to point them to the ESAPI source code, which +we believe will convince them that ESAPI is not a cryptographic module. +(Rather, it only provides a wrapper to call other cryptographic modules +through the standard JCE APIs.) +
Acknowledgments
+The OWASP ESAPI development team would like to acknowledge the contributions +of cryptographers David A. Wagner and Ian Grigg. David provided the +outline of how to securely compute derived keys for confidentiality +and authenticity from a single master key and Ian convinced us +to take a packetizing approach to laying out the portable, serialized +CipherText object.
++In addition, Kevin Kenan has agreed to review all the crypto code +from ESAPI 2.0-rc5 or 2.0-rc6 candidate release. Others are invited +to participate as well, especially those with a background in cryptography. +(See +"Request to review ESAPI 2.0 crypto" for details.) +
+I would also like to thank Jessica Fitzgerald-McKay and Andy Sampson of +the Systems and Network Analysis Center of the NSA for their excellent feedback in +response to the review request made in Google Issue #81. Working with bureaucracy +is not something that I do particularly well, but Jessica and Andy made it as +painless as it possibly could be. Their feedback, which at this point, +unfortunately we are unable to quote, was generally favorable, but in the +places where they had recommendations, these were very precise and +helpful. +
+Lastly, I would like to thank Jeffrey Walton of Software Integrity, LLC. +Jeff provided an extremely thorough analysis of ESAPI 2.0's (as of 2.0_rc10) +Key Derivation Function (KDF). Jeff's analysis convinced me to bring ESAPI's +KDF more in line with NIST's recommendations for KDFs as described in +NIST Special Publication 800-108 (and specifically section 5.1). You can +read about Jeff's review at + +Analysis of ESAPI 2.0's Key Derivation Function + +
+ + diff --git a/documentation/esapi4java-core-2.1-release-notes.txt b/documentation/esapi4java-core-2.1-release-notes.txt new file mode 100644 index 000000000..e97e56c93 --- /dev/null +++ b/documentation/esapi4java-core-2.1-release-notes.txt @@ -0,0 +1,68 @@ +ESAPI for Java - 2.1.0 Release Notes + +1) Fixed security issue #306, a vulnerability discovered by Phillipe Arteau. + This fix necessitated removing the deprecated encrypt() and decrupt() methods + that were intended to provide backward compatibility with ESAPI 1.4. + As it turns out, there was no way to fix this bug without a major rewrite + unless these methods were removed. However, as these two methods have been + deprecated more than 2 years ago and they are known to be insecure + (they are vulnerable to padding oracle attacks), the ESAPI team has + decided to remove them in accordance to their support policy. + + See comments for issue #306 for further details, as well as additional + safety precautions that you may wish to take in the unlikely, but possible + event that this vulnerability resulted in an actual security breach. + + Finally, since the removal of these methods constitute an interface change + (to the Encryptor interface), this is considered a minor release (2.1) + rather than simply a patch release (2.0.2). + + Please note that there are further updates planned to further strengthen + the MAC that ESAPI crypt uses. However, because they will require some + design changes, they may not be out for another month. Note that these + fixes do not correct any *known* vulnerabilities, but will address + some potential weaknesses in what is not included in the MAC (such as + the crypto version). + +2) Other Google Issues fixed: 257, 271, and 292 are all fixed in this release. + +3) Fixed Javadoc for Encoder.encryptForJavaScript(). [Revision r1879] + +4) DefaultEncryptedProperties - made minor Javadoc changes. + +5) The ESAPI 2.0 Encryptor.encrypt() methods now all throw an appropriate + IllegalArgumentException if any of the arguments are null. Previously, + if any of the arguments were null you would either get an AssertionError + (if you had assertions enabled) or a default NullPointerException when + assertions were disabled. While IllegalArgumentException is still an + unchecked RuntimeException, note that if you were previously catching + NullPointerExceptions for these cases, you may need to change your code. + +6) The public constructor, CiphertextSerializer(CipherText ct), was changed + to explicitly check that the parameter is not null. Previously it had + checked with assertions which might later result in a NullPointerException + being thrown if assertions were disabled. Now if the parameter is null, + an appropriate IllegalArgumentException is thrown. This should not really + affect existing code (unless you are experimenting implementing your own + crypto) since user code should not really be using CiperTextSerializer + directly. + +7) Some of the setter methods in KeyDerivationFunction were changed to explicitly + check for invalid arguments and throw an IllegalArgumentException rather than + checking these parameters via assertions. This should not affect general + user code as most would not be calling the KeyDerivationFunction class + directly. + +8) Other miscellaneous minor code clean-up, mostly to remove compiler warnings. + +NOTE: A follow-up patch release is scheduled within the next few months to + address some questionable design decisions regarding what data in + the serialized ciphertext should be authenticated via the MAC. For + instance, presently only the IV+ciphertext is MAC'd (as would be the + equivalent case of when you would use an authenticated combined cipher + mode such as GCM or CCM). A deeper analysis of the design is required + based on findings in Google Issue # 306. I will periodically try + to keep the ESAPI mailing lists updated with the progress so watch + there for emerging details and anticipated schedule. + +-Kevin W. Wall- -
- -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Constant Field Values
--Contents
-
-
- org.owasp.* -
| -org.owasp.* | -
- -
| org.owasp.esapi.HTTPUtilities | -||
-public static final java.lang.String |
-REMEMBER_TOKEN_COOKIE_NAME |
-"ESAPIRememberToken" |
-
- -
- -
| org.owasp.esapi.Logger | -||
-public static final java.lang.String |
-FUNCTIONALITY |
-"FUNCTIONALITY" |
-
-public static final java.lang.String |
-PERFORMANCE |
-"PERFORMANCE" |
-
-public static final java.lang.String |
-SECURITY |
-"SECURITY" |
-
-public static final java.lang.String |
-USABILITY |
-"USABILITY" |
-
- -
- -
| org.owasp.esapi.codecs.Base64 | -||
-public static final int |
-DECODE |
-0 |
-
-public static final int |
-DONT_BREAK_LINES |
-8 |
-
-public static final int |
-ENCODE |
-1 |
-
-public static final int |
-GZIP |
-2 |
-
-public static final int |
-NO_OPTIONS |
-0 |
-
-public static final int |
-ORDERED |
-32 |
-
-public static final int |
-URL_SAFE |
-16 |
-
- -
- -
| org.owasp.esapi.codecs.MySQLCodec | -||
-public static final int |
-ANSI_MODE |
-1 |
-
-public static final int |
-MYSQL_MODE |
-0 |
-
- -
- -
| org.owasp.esapi.reference.DefaultSecurityConfiguration | -||
-public static final java.lang.String |
-RESOURCE_DIRECTORY |
-"org.owasp.esapi.resources" |
-
- -
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/deprecated-list.html b/javadoc/deprecated-list.html deleted file mode 100644 index 35267c2b1..000000000 --- a/javadoc/deprecated-list.html +++ /dev/null @@ -1,134 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Deprecated API
-- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/help-doc.html b/javadoc/help-doc.html deleted file mode 100644 index 7e470b55a..000000000 --- a/javadoc/help-doc.html +++ /dev/null @@ -1,193 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-How This API Document Is Organized
--Overview
-- ---The Overview page is the front page of this API document and provides a list of all packages with a summary for each. This page can also contain an overall description of the set of packages.
-Package
-- ---Each package has a page that contains a list of its classes and interfaces, with a summary for each. This page can contain four categories:
-
-- Interfaces (italic)
- Classes
- Exceptions
- Errors
-Class/Interface
-- ---Each class, interface, nested class and nested interface has its own separate page. Each of these pages has three sections consisting of a class/interface description, summary tables, and detailed member descriptions:
-
-Each summary entry contains the first sentence from the detailed description for that item. The summary entries are alphabetical, while the detailed descriptions are in the order they appear in the source code. This preserves the logical groupings established by the programmer.- Class inheritance diagram
- Direct Subclasses
- All Known Subinterfaces
- All Known Implementing Classes
- Class/interface declaration
- Class/interface description -
-
- Nested Class Summary
- Field Summary
- Constructor Summary
- Method Summary -
-
- Field Detail
- Constructor Detail
- Method Detail
-Use
--Each documented package, class and interface has its own Use page. This page describes what packages, classes, methods, constructors and fields use any part of the given class or package. Given a class or interface A, its Use page includes subclasses of A, fields declared as A, methods that return A, and methods and constructors with parameters of type A. You can access this page by first going to the package, class or interface, then clicking on the "Use" link in the navigation bar.-
-Tree (Class Hierarchy)
--There is a Class Hierarchy page for all packages, plus a hierarchy for each package. Each hierarchy page contains a list of classes and a list of interfaces. The classes are organized by inheritance structure starting with-java.lang.Object. The interfaces do not inherit fromjava.lang.Object.-
-- When viewing the Overview page, clicking on "Tree" displays the hierarchy for all packages.
- When viewing a particular package, class or interface page, clicking "Tree" displays the hierarchy for only that package.
-Deprecated API
--The Deprecated API page lists all of the API that have been deprecated. A deprecated API is not recommended for use, generally due to improvements, and a replacement API is usually given. Deprecated APIs may be removed in future implementations.-
-Index
--The Index contains an alphabetic list of all classes, interfaces, constructors, methods, and fields.-
-Prev/Next
-These links take you to the next or previous class, interface, package, or related page.-Frames/No Frames
-These links show and hide the HTML frames. All pages are available with or without frames. --
-Serialized Form
-Each serializable or externalizable class has a description of its serialization fields and methods. This information is of interest to re-implementors, not to developers using the API. While there is no link in the navigation bar, you can get to this information by going to any serialized class and clicking "Serialized Form" in the "See also" section of the class description. -
-
-
-This help file applies to API documentation generated using the standard doclet.
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-1.html b/javadoc/index-files/index-1.html deleted file mode 100644 index 22b859fd7..000000000 --- a/javadoc/index-files/index-1.html +++ /dev/null @@ -1,368 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-A
--
-
- ANONYMOUS - -Static variable in interface org.owasp.esapi.User -
- The ANONYMOUS user is used to represent an unidentified user. -
- ANSI_MODE - -Static variable in class org.owasp.esapi.codecs.MySQLCodec -
- -
- AccessControlException - exception org.owasp.esapi.errors.AccessControlException.
- An AccessControlException should be thrown when a user attempts to access a - resource that they are not authorized for.
- AccessControlException(String, String) - -Constructor for class org.owasp.esapi.errors.AccessControlException -
- Creates a new instance of EnterpriseSecurityException. -
- AccessControlException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.AccessControlException -
- Instantiates a new access control exception. -
- AccessController - interface org.owasp.esapi.AccessController.
- The IAccessController interface defines a set of methods that can be used in a wide variety of applications to - enforce access control.
- AccessControllerTest - class org.owasp.esapi.reference.AccessControllerTest.
- The Class AccessControllerTest.
- AccessControllerTest(String) - -Constructor for class org.owasp.esapi.reference.AccessControllerTest -
- Instantiates a new access controller test. -
- AccessReferenceMap - interface org.owasp.esapi.AccessReferenceMap.
- The AccessReferenceMap interface is used to map from a set of internal - direct object references to a set of indirect references that are safe to - disclose publicly.
- AccessReferenceMapTest - class org.owasp.esapi.reference.AccessReferenceMapTest.
- The Class AccessReferenceMapTest.
- AccessReferenceMapTest(String) - -Constructor for class org.owasp.esapi.reference.AccessReferenceMapTest -
- Instantiates a new access reference map test. -
- AllTests - class org.owasp.esapi.AllTests.
- The Class AllTests.
- AllTests(String) - -Constructor for class org.owasp.esapi.AllTests -
- Instantiates a new all tests. -
- AuthenticationAccountsException - exception org.owasp.esapi.errors.AuthenticationAccountsException.
- An AuthenticationException should be thrown when anything goes wrong during - login or logout.
- AuthenticationAccountsException(String, String) - -Constructor for class org.owasp.esapi.errors.AuthenticationAccountsException -
- Creates a new instance of EnterpriseSecurityException. -
- AuthenticationAccountsException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.AuthenticationAccountsException -
- Instantiates a new authentication exception. -
- AuthenticationCredentialsException - exception org.owasp.esapi.errors.AuthenticationCredentialsException.
- An AuthenticationException should be thrown when anything goes wrong during - login or logout.
- AuthenticationCredentialsException(String, String) - -Constructor for class org.owasp.esapi.errors.AuthenticationCredentialsException -
- Creates a new instance of EnterpriseSecurityException. -
- AuthenticationCredentialsException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.AuthenticationCredentialsException -
- Instantiates a new authentication exception. -
- AuthenticationException - exception org.owasp.esapi.errors.AuthenticationException.
- An AuthenticationException should be thrown when anything goes wrong during - login or logout.
- AuthenticationException(String, String) - -Constructor for class org.owasp.esapi.errors.AuthenticationException -
- Creates a new instance of EnterpriseSecurityException. -
- AuthenticationException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.AuthenticationException -
- Instantiates a new authentication exception. -
- AuthenticationHostException - exception org.owasp.esapi.errors.AuthenticationHostException.
- An AuthenticationHostException should be thrown when there is a problem with - the host involved with authentication, particularly if the host changes unexpectedly.
- AuthenticationHostException(String, String) - -Constructor for class org.owasp.esapi.errors.AuthenticationHostException -
- Creates a new instance of AuthenticationHostException. -
- AuthenticationHostException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.AuthenticationHostException -
- Instantiates a new authentication exception. -
- AuthenticationLoginException - exception org.owasp.esapi.errors.AuthenticationLoginException.
- An AuthenticationException should be thrown when anything goes wrong during - login or logout.
- AuthenticationLoginException(String, String) - -Constructor for class org.owasp.esapi.errors.AuthenticationLoginException -
- Creates a new instance of EnterpriseSecurityException. -
- AuthenticationLoginException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.AuthenticationLoginException -
- Instantiates a new authentication exception. -
- Authenticator - interface org.owasp.esapi.Authenticator.
- The Authenticator interface defines a set of methods for generating and - handling account credentials and session identifiers.
- AuthenticatorTest - class org.owasp.esapi.reference.AuthenticatorTest.
- The Class AuthenticatorTest.
- AuthenticatorTest(String) - -Constructor for class org.owasp.esapi.reference.AuthenticatorTest -
- Instantiates a new authenticator test. -
- AvailabilityException - exception org.owasp.esapi.errors.AvailabilityException.
- An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy.
- AvailabilityException(String, String) - -Constructor for class org.owasp.esapi.errors.AvailabilityException -
- Creates a new instance of AvailabilityException. -
- AvailabilityException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.AvailabilityException -
- Instantiates a new AvailabilityException. -
- accessController() - -Static method in class org.owasp.esapi.ESAPI -
- -
- actions - -Variable in class org.owasp.esapi.SecurityConfiguration.Threshold -
- -
- addCSRFToken(String) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Adds the current user's CSRF token (see User.getCSRFToken()) to the URL for purposes of preventing CSRF attacks. -
- addCSRFToken(String) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- addCookie(Cookie) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Add a cookie to the response after ensuring that there are no encoded or - illegal characters in the name and name and value. -
- addCookie(String, String, int, String, String) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Add a cookie to the response after ensuring that there are no encoded or - illegal characters in the name and name and value. -
- addCookie(Cookie) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- addDateHeader(String, long) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Add a cookie to the response after ensuring that there are no encoded or - illegal characters in the name. -
- addDateHeader(String, long) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- addDirectReference(Object) - -Method in interface org.owasp.esapi.AccessReferenceMap -
- Adds a direct reference to the AccessReferenceMap and generates an associated indirect reference. -
- addDirectReference(Object) - -Method in class org.owasp.esapi.reference.IntegerAccessReferenceMap -
- Adds a direct reference and a new indirect reference, overwriting any existing values. -
- addDirectReference(Object) - -Method in class org.owasp.esapi.reference.RandomAccessReferenceMap -
- Adds a direct reference and a new random indirect reference, overwriting any existing values. -
- addError(String, ValidationException) - -Method in class org.owasp.esapi.ValidationErrorList -
- Adds a new error to list with a unique named context. -
- addEvent(String, String) - -Method in interface org.owasp.esapi.IntrusionDetector -
- Adds the event to the IntrusionDetector. -
- addEvent(String, String) - -Method in class org.owasp.esapi.reference.DefaultIntrusionDetector -
- Adds the event to the IntrusionDetector. -
- addException(Exception) - -Method in interface org.owasp.esapi.IntrusionDetector -
- Adds the exception to the IntrusionDetector. -
- addException(Exception) - -Method in class org.owasp.esapi.reference.DefaultIntrusionDetector -
- This implementation uses an exception store in each User object to track - exceptions. -
- addHeader(String, String) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Add a header to the response after ensuring that there are no encoded or - illegal characters in the name and name and value. -
- addHeader(String, String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- Adds the header. -
- addHeader(String, String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- addIntHeader(String, int) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Add an int header to the response after ensuring that there are no - encoded or illegal characters in the name and name. -
- addIntHeader(String, int) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- addParameter(String, String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- Adds the parameter. -
- addRole(String) - -Method in interface org.owasp.esapi.User -
- Adds a role to an account. -
- addRole(String) - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- addRoles(Set) - -Method in interface org.owasp.esapi.User -
- Adds a set of roles to an account. -
- addRoles(Set) - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- assertAuthorizedForData(String) - -Method in interface org.owasp.esapi.AccessController -
- Checks if an account is authorized to access the referenced data. -
- assertAuthorizedForData(String) - -Method in class org.owasp.esapi.reference.FileBasedAccessController -
- -
- assertAuthorizedForFile(String) - -Method in interface org.owasp.esapi.AccessController -
- Checks if an account is authorized to access the referenced file. -
- assertAuthorizedForFile(String) - -Method in class org.owasp.esapi.reference.FileBasedAccessController -
- -
- assertAuthorizedForFunction(String) - -Method in interface org.owasp.esapi.AccessController -
- Checks if an account is authorized to access the referenced function. -
- assertAuthorizedForFunction(String) - -Method in class org.owasp.esapi.reference.FileBasedAccessController -
- -
- assertAuthorizedForService(String) - -Method in interface org.owasp.esapi.AccessController -
- Checks if an account is authorized to access the referenced service. -
- assertAuthorizedForService(String) - -Method in class org.owasp.esapi.reference.FileBasedAccessController -
- -
- assertAuthorizedForURL(String) - -Method in interface org.owasp.esapi.AccessController -
- Checks if an account is authorized to access the referenced URL. -
- assertAuthorizedForURL(String) - -Method in class org.owasp.esapi.reference.FileBasedAccessController -
- -
- assertIsValidHTTPRequest() - -Method in interface org.owasp.esapi.Validator -
- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. -
- assertIsValidHTTPRequest() - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. -
- assertIsValidHTTPRequestParameterSet(String, Set, Set) - -Method in interface org.owasp.esapi.Validator -
- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. -
- assertIsValidHTTPRequestParameterSet(String, Set, Set, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. -
- assertIsValidHTTPRequestParameterSet(String, Set, Set) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. -
- assertIsValidHTTPRequestParameterSet(String, Set, Set, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- ValidationErrorList variant of assertIsValidHTTPRequestParameterSet -
- assertSecureRequest(HttpServletRequest) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Ensures that the current request uses SSL and POST to protect any sensitive parameters - in the querystring from being sniffed or logged. -
- assertSecureRequest(HttpServletRequest) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- Verifies that the request is "secure" by checking that the method is a POST and - that SSL has been used. -
- assertValidFileUpload(String, String, String, byte[], int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Validates the filepath, filename, and content of a file. -
- assertValidFileUpload(String, String, String, byte[], int, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Validates the filepath, filename, and content of a file. -
- assertValidFileUpload(String, String, String, byte[], int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Validates the filepath, filename, and content of a file. -
- assertValidFileUpload(String, String, String, byte[], int, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- ValidationErrorList variant of assertValidFileUpload -
- authenticator() - -Static method in class org.owasp.esapi.ESAPI -
- -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-10.html b/javadoc/index-files/index-10.html deleted file mode 100644 index 9cf2d4729..000000000 --- a/javadoc/index-files/index-10.html +++ /dev/null @@ -1,143 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-J
--
-
- JavaEncryptor - class org.owasp.esapi.reference.JavaEncryptor.
- Reference implementation of the Encryptor interface.
- JavaEncryptor() - -Constructor for class org.owasp.esapi.reference.JavaEncryptor -
- -
- JavaLogFactory - class org.owasp.esapi.reference.JavaLogFactory.
- Reference implementation of the LogFactory and Logger interfaces.
- JavaLogFactory(String) - -Constructor for class org.owasp.esapi.reference.JavaLogFactory -
- -
- JavaScriptCodec - class org.owasp.esapi.codecs.JavaScriptCodec.
- Implementation of the Codec interface for backslash encoding frequently used in JavaScript.
- JavaScriptCodec() - -Constructor for class org.owasp.esapi.codecs.JavaScriptCodec -
- -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-11.html b/javadoc/index-files/index-11.html deleted file mode 100644 index d7fde2444..000000000 --- a/javadoc/index-files/index-11.html +++ /dev/null @@ -1,152 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-K
--
-
- keySet() - -Method in interface org.owasp.esapi.EncryptedProperties -
- Key set. -
- keySet() - -Method in class org.owasp.esapi.reference.DefaultEncryptedProperties -
- Key set. -
- killAllCookies(HttpServletRequest, HttpServletResponse) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Kill all cookies received in the last request from the browser. -
- killAllCookies(HttpServletRequest, HttpServletResponse) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- killCookie(HttpServletRequest, HttpServletResponse, String) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Kills the specified cookie by setting a new cookie that expires immediately. -
- killCookie(HttpServletRequest, HttpServletResponse, String) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-12.html b/javadoc/index-files/index-12.html deleted file mode 100644 index 2fcb7d8c2..000000000 --- a/javadoc/index-files/index-12.html +++ /dev/null @@ -1,195 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-L
--
-
- LogFactory - interface org.owasp.esapi.LogFactory.
- The LogFactory interface is intended to allow substitution of various logging packages, while providing - a common interface to access them.
- Logger - interface org.owasp.esapi.Logger.
- The Logger interface defines a set of methods that can be used to log - security events.
- LoggerTest - class org.owasp.esapi.reference.LoggerTest.
- The Class LoggerTest.
- LoggerTest(String) - -Constructor for class org.owasp.esapi.reference.LoggerTest -
- Instantiates a new logger test. -
- load(InputStream) - -Method in interface org.owasp.esapi.EncryptedProperties -
- Load. -
- load(InputStream) - -Method in class org.owasp.esapi.reference.DefaultEncryptedProperties -
- Load. -
- lock() - -Method in interface org.owasp.esapi.User -
- Lock the user's account. -
- lock() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- log() - -Static method in class org.owasp.esapi.ESAPI -
- -
- logHTTPRequest(HttpServletRequest, Logger) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Format the Source IP address, URL, URL parameters, and all form - parameters into a string suitable for the log file. -
- logHTTPRequest(HttpServletRequest, Logger, List) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Format the Source IP address, URL, URL parameters, and all form - parameters into a string suitable for the log file. -
- logHTTPRequest(HttpServletRequest, Logger) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- logHTTPRequest(HttpServletRequest, Logger, List) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- Formats an HTTP request into a log suitable string. -
- login(HttpServletRequest, HttpServletResponse) - -Method in interface org.owasp.esapi.Authenticator -
- Authenticates the user's credentials from the HttpServletRequest if - necessary, creates a session if necessary, and sets the user as the - current user. -
- login(HttpServletRequest, HttpServletResponse) - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- This method should be called for every HTTP request, to login the current user either from the session of HTTP - request. -
- loginWithPassword(String) - -Method in interface org.owasp.esapi.User -
- Login with password. -
- loginWithPassword(String) - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- logout() - -Method in interface org.owasp.esapi.Authenticator -
- Logs out the current user. -
- logout() - -Method in interface org.owasp.esapi.User -
- Logout this user. -
- logout() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- logout() - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- Log out the current user. -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-13.html b/javadoc/index-files/index-13.html deleted file mode 100644 index 5e69b7ed2..000000000 --- a/javadoc/index-files/index-13.html +++ /dev/null @@ -1,157 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-M
--
-
- MYSQL_MODE - -Static variable in class org.owasp.esapi.codecs.MySQLCodec -
- -
- MySQLCodec - class org.owasp.esapi.codecs.MySQLCodec.
- Implementation of the Codec interface for MySQL strings.
- MySQLCodec(int) - -Constructor for class org.owasp.esapi.codecs.MySQLCodec -
- -
- main(String[]) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Encodes or decodes two files from the command line; - feel free to delete this method (in fact you probably should) - if you're embedding this code into a larger program. -
- main(String[]) - -Static method in class org.owasp.esapi.codecs.HTMLEntityCodec -
- -
- main(String[]) - -Static method in class org.owasp.esapi.reference.DefaultEncryptedProperties -
- The main method. -
- main(String[]) - -Static method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- Fail safe main program to add or update an account in an emergency. -
- mark() - -Method in class org.owasp.esapi.codecs.PushbackString -
- -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-14.html b/javadoc/index-files/index-14.html deleted file mode 100644 index 900a8e111..000000000 --- a/javadoc/index-files/index-14.html +++ /dev/null @@ -1,154 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-N
--
-
- NO_OPTIONS - -Static variable in class org.owasp.esapi.codecs.Base64 -
- No options specified. -
- name - -Variable in class org.owasp.esapi.SecurityConfiguration.Threshold -
- -
- next() - -Method in class org.owasp.esapi.codecs.PushbackString -
- -
- nextHex() - -Method in class org.owasp.esapi.codecs.PushbackString -
- -
- normalize(String) - -Method in interface org.owasp.esapi.Encoder -
- Reduce all non-ascii characters to their ASCII form so that simpler - validation rules can be applied. -
- normalize(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- Normalizes special characters down to ASCII using the Normalizer built - into Java. -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-15.html b/javadoc/index-files/index-15.html deleted file mode 100644 index db02c2657..000000000 --- a/javadoc/index-files/index-15.html +++ /dev/null @@ -1,144 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-O
--
-
- ORDERED - -Static variable in class org.owasp.esapi.codecs.Base64 -
- Encode using the special "ordered" dialect of Base64 described here: - http://www.faqs.org/qa/rfcc-1940.html. -
- OracleCodec - class org.owasp.esapi.codecs.OracleCodec.
- Implementation of the Codec interface for Oracle strings.
- OracleCodec() - -Constructor for class org.owasp.esapi.codecs.OracleCodec -
- -
- org.owasp.esapi - package org.owasp.esapi
- The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications.
- org.owasp.esapi.codecs - package org.owasp.esapi.codecs
- org.owasp.esapi.errors - package org.owasp.esapi.errors
- A set of exception classes designed to model the error conditions that -frequently arise in enterprise web applications and web services.
- org.owasp.esapi.filters - package org.owasp.esapi.filters
- org.owasp.esapi.http - package org.owasp.esapi.http
- A few simple mock classes to help test the ESAPI reference -implementation.
- org.owasp.esapi.reference - package org.owasp.esapi.reference
- This package contains reference implementations of the ESAPI interfaces.
- org.owasp.esapi.tags - package org.owasp.esapi.tags
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-16.html b/javadoc/index-files/index-16.html deleted file mode 100644 index 0a8c63c0a..000000000 --- a/javadoc/index-files/index-16.html +++ /dev/null @@ -1,156 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-P
--
-
- PERFORMANCE - -Static variable in interface org.owasp.esapi.Logger -
- -
- PercentCodec - class org.owasp.esapi.codecs.PercentCodec.
- Implementation of the Codec interface for percent encoding (aka URL encoding).
- PercentCodec() - -Constructor for class org.owasp.esapi.codecs.PercentCodec -
- -
- PushbackString - class org.owasp.esapi.codecs.PushbackString.
- The pushback string is used by Codecs to allow them to push decoded characters back onto a string - for further decoding.
- PushbackString(String) - -Constructor for class org.owasp.esapi.codecs.PushbackString -
- -
- peek() - -Method in class org.owasp.esapi.codecs.PushbackString -
- -
- peek(char) - -Method in class org.owasp.esapi.codecs.PushbackString -
- -
- pushback(Character) - -Method in class org.owasp.esapi.codecs.PushbackString -
- -
- putValue(String, Object) - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-17.html b/javadoc/index-files/index-17.html deleted file mode 100644 index 114c7e9ba..000000000 --- a/javadoc/index-files/index-17.html +++ /dev/null @@ -1,226 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-R
--
-
- REMEMBER_TOKEN_COOKIE_NAME - -Static variable in interface org.owasp.esapi.HTTPUtilities -
- Key for remember token cookie -
- RESOURCE_DIRECTORY - -Static variable in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- -
- RandomAccessReferenceMap - class org.owasp.esapi.reference.RandomAccessReferenceMap.
- Reference implementation of the AccessReferenceMap interface.
- RandomAccessReferenceMap() - -Constructor for class org.owasp.esapi.reference.RandomAccessReferenceMap -
- This AccessReferenceMap implementation uses short random strings to - create a layer of indirection. -
- RandomAccessReferenceMap(Set) - -Constructor for class org.owasp.esapi.reference.RandomAccessReferenceMap -
- Instantiates a new access reference map. -
- Randomizer - interface org.owasp.esapi.Randomizer.
- The IRandomizer interface defines a set of methods for creating - cryptographically random numbers and strings.
- RandomizerTest - class org.owasp.esapi.reference.RandomizerTest.
- The Class RandomizerTest.
- RandomizerTest(String) - -Constructor for class org.owasp.esapi.reference.RandomizerTest -
- Instantiates a new randomizer test. -
- randomizer() - -Static method in class org.owasp.esapi.ESAPI -
- -
- read() - -Method in class org.owasp.esapi.codecs.Base64.InputStream -
- Reads enough of the input stream to convert - to/from Base64 and returns the next byte. -
- read(byte[], int, int) - -Method in class org.owasp.esapi.codecs.Base64.InputStream -
- Calls
Base64.InputStream.read()repeatedly until the end of stream - is reached or len bytes are read. - - read() - -Method in class org.owasp.esapi.http.TestServletInputStream -
- read -
- removeAttribute(String) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- removeAttribute(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- removeAttribute(String) - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- removeDirectReference(Object) - -Method in interface org.owasp.esapi.AccessReferenceMap -
- Removes a direct reference and its associated indirect reference from the AccessReferenceMap. -
- removeDirectReference(Object) - -Method in class org.owasp.esapi.reference.IntegerAccessReferenceMap -
- Remove a direct reference and the corresponding indirect reference. -
- removeDirectReference(Object) - -Method in class org.owasp.esapi.reference.RandomAccessReferenceMap -
- Remove a direct reference and the corresponding indirect reference. -
- removeParameter(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- removeRole(String) - -Method in interface org.owasp.esapi.User -
- Removes a role from an account. -
- removeRole(String) - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- removeUser(String) - -Method in interface org.owasp.esapi.Authenticator -
- Removes the account. -
- removeUser(String) - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- -
- removeValue(String) - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- reset() - -Method in class org.owasp.esapi.codecs.PushbackString -
- -
- reset() - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- reset() - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- resetBuffer() - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- resetBuffer() - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- resetCSRFToken() - -Method in interface org.owasp.esapi.User -
- Returns a token to be used as a prevention against CSRF attacks. -
- resetCSRFToken() - -Method in class org.owasp.esapi.reference.DefaultUser -
- In this implementation, we have chosen to use a random token that is - stored in the User object. -
- resumeEncoding() - -Method in class org.owasp.esapi.codecs.Base64.OutputStream -
- Resumes encoding of the stream. -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-18.html b/javadoc/index-files/index-18.html deleted file mode 100644 index 4e1d8b540..000000000 --- a/javadoc/index-files/index-18.html +++ /dev/null @@ -1,544 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-S
--
-
- SECURITY - -Static variable in interface org.owasp.esapi.Logger -
- -
- SafeFile - class org.owasp.esapi.SafeFile.
- Extension to java.io.File to prevent against null byte injections and - other unforeseen problems resulting from unprintable characters - causing problems in path lookups.
- SafeFile(String) - -Constructor for class org.owasp.esapi.SafeFile -
- -
- SafeFile(String, String) - -Constructor for class org.owasp.esapi.SafeFile -
- -
- SafeFile(File, String) - -Constructor for class org.owasp.esapi.SafeFile -
- -
- SafeFile(URI) - -Constructor for class org.owasp.esapi.SafeFile -
- -
- SafeFileTest - class org.owasp.esapi.reference.SafeFileTest.
- The Class ExecutorTest.
- SafeFileTest(String) - -Constructor for class org.owasp.esapi.reference.SafeFileTest -
- Instantiates a new executor test. -
- SafeHTTPFilter - class org.owasp.esapi.filters.SafeHTTPFilter.
- This filter wraps the incoming request and outgoing response and overrides - many methods with safer versions.
- SafeHTTPFilter() - -Constructor for class org.owasp.esapi.filters.SafeHTTPFilter -
- -
- SafeRequest - class org.owasp.esapi.filters.SafeRequest.
- This request wrapper simply overrides unsafe methods in the HttpServletRequest - API with safe versions that return canonicalized data where possible.
- SafeRequest(HttpServletRequest) - -Constructor for class org.owasp.esapi.filters.SafeRequest -
- Construct a safe request that overrides the default request methods with safer versions. -
- SafeResponse - class org.owasp.esapi.filters.SafeResponse.
- This response wrapper simply overrides unsafe methods in the - HttpServletResponse API with safe versions.
- SafeResponse(HttpServletResponse) - -Constructor for class org.owasp.esapi.filters.SafeResponse -
- Construct a safe response that overrides the default response methods - with safer versions. -
- SecurityConfiguration - interface org.owasp.esapi.SecurityConfiguration.
- The ISecurityConfiguration interface stores all configuration information - that directs the behavior of the ESAPI implementation.
- SecurityConfiguration.Threshold - class org.owasp.esapi.SecurityConfiguration.Threshold.
- Models a simple threshold as a count and an interval, along with a set of actions to take if the threshold is exceeded.
- SecurityConfiguration.Threshold(String, int, long, List) - -Constructor for class org.owasp.esapi.SecurityConfiguration.Threshold -
- -
- StringUtilities - class org.owasp.esapi.StringUtilities.
- String utilities used in various filters.
- StringUtilities() - -Constructor for class org.owasp.esapi.StringUtilities -
- -
- safeReadLine(InputStream, int) - -Method in interface org.owasp.esapi.Validator -
- Reads from an input stream until end-of-line or a maximum number of - characters. -
- safeReadLine(InputStream, int) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- This implementation reads until a newline or the specified number of - characters. -
- safeSendForward(HttpServletRequest, HttpServletResponse, String, String) - -Method in interface org.owasp.esapi.HTTPUtilities -
- This method perform a forward to any resource located inside the WEB-INF directory. -
- safeSendForward(HttpServletRequest, HttpServletResponse, String, String) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- safeSetContentType(HttpServletResponse) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Sets the content type on each HTTP response, to help protect against cross-site scripting attacks and other types - of injection into HTML documents. -
- safeSetContentType(HttpServletResponse) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- Set the character encoding on every HttpServletResponse in order to limit - the ways in which the input data can be represented. -
- seal(String, long) - -Method in interface org.owasp.esapi.Encryptor -
- Creates a seal that binds a set of data and includes an expiration timestamp. -
- seal(String, long) - -Method in class org.owasp.esapi.reference.JavaEncryptor -
- -
- securityConfiguration() - -Static method in class org.owasp.esapi.ESAPI -
- -
- sendError(int) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Override the error code with a 200 in order to confound attackers using - automated scanners. -
- sendError(int, String) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Override the error code with a 200 in order to confound attackers using - automated scanners. -
- sendError(int) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- sendError(int, String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- sendRedirect(String) - -Method in class org.owasp.esapi.filters.SafeResponse -
- This method generates a redirect response that can only be used to redirect the browser to safe locations, - as configured in the ESAPI security configuration. -
- sendRedirect(String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- setAccessController(AccessController) - -Static method in class org.owasp.esapi.ESAPI -
- -
- setAccessedTime(long) - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- setAccountName(String) - -Method in interface org.owasp.esapi.User -
- Sets the account name. -
- setAccountName(String) - -Method in class org.owasp.esapi.reference.DefaultUser -
- Sets the account name. -
- setAttribute(String, Object) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- setAttribute(String, Object) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- setAttribute(String, Object) - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- setAuthenticator(Authenticator) - -Static method in class org.owasp.esapi.ESAPI -
- -
- setBufferSize(int) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- setBufferSize(int) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- setCharacterEncoding(String) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Sets the character encoding to the ESAPI configured encoding. -
- setCharacterEncoding(String) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Sets the character encoding to the ESAPI configured encoding. -
- setCharacterEncoding(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- setCharacterEncoding(String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- setContentLength(int) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- setContentLength(int) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- setContentType(String) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- setContentType(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- setContentType(String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- setContext(String) - -Method in class org.owasp.esapi.errors.ValidationException -
- Set's the UI reference that caused this ValidationException -
- setCookie(String, String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- setCookies(ArrayList) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- Sets the cookies. -
- setCreationTime(long) - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- setCurrentHTTP(HttpServletRequest, HttpServletResponse) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Stores the current HttpRequest and HttpResponse so that they may be readily accessed throughout - ESAPI (and elsewhere) -
- setCurrentHTTP(HttpServletRequest, HttpServletResponse) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- setCurrentUser(User) - -Method in interface org.owasp.esapi.Authenticator -
- Sets the currently logged in User. -
- setCurrentUser(User) - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- -
- setDateHeader(String, long) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Add a date header to the response after ensuring that there are no - encoded or illegal characters in the name. -
- setDateHeader(String, long) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- setEncoder(Encoder) - -Static method in class org.owasp.esapi.ESAPI -
- -
- setEncryptor(Encryptor) - -Static method in class org.owasp.esapi.ESAPI -
- -
- setExecutor(Executor) - -Static method in class org.owasp.esapi.ESAPI -
- -
- setExpirationTime(Date) - -Method in interface org.owasp.esapi.User -
- Sets the time when this user's account will expire. -
- setExpirationTime(Date) - -Method in class org.owasp.esapi.reference.DefaultUser -
- Sets the expiration time. -
- setHeader(String, String) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Add a header to the response after ensuring that there are no encoded or - illegal characters in the name and value. -
- setHeader(String, String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- setHttpUtilities(HTTPUtilities) - -Static method in class org.owasp.esapi.ESAPI -
- -
- setIntHeader(String, int) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Add an int header to the response after ensuring that there are no - encoded or illegal characters in the name. -
- setIntHeader(String, int) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- setIntrusionDetector(IntrusionDetector) - -Static method in class org.owasp.esapi.ESAPI -
- -
- setLastFailedLoginTime(Date) - -Method in interface org.owasp.esapi.User -
- Set the time of the last failed login for this user. -
- setLastFailedLoginTime(Date) - -Method in class org.owasp.esapi.reference.DefaultUser -
- Sets the last failed login time. -
- setLastHostAddress(String) - -Method in interface org.owasp.esapi.User -
- Set the last remote host address used by this user. -
- setLastHostAddress(String) - -Method in class org.owasp.esapi.reference.DefaultUser -
- Sets the last remote host address used by this User. -
- setLastLoginTime(Date) - -Method in interface org.owasp.esapi.User -
- Set the time of the last successful login for this user. -
- setLastLoginTime(Date) - -Method in class org.owasp.esapi.reference.DefaultUser -
- Sets the last login time. -
- setLastPasswordChangeTime(Date) - -Method in interface org.owasp.esapi.User -
- Set the time of the last password change for this user. -
- setLastPasswordChangeTime(Date) - -Method in class org.owasp.esapi.reference.DefaultUser -
- Sets the last password change time. -
- setLocale(Locale) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- setLocale(Locale) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- setLogFactory(LogFactory) - -Static method in class org.owasp.esapi.ESAPI -
- -
- setMaxInactiveInterval(int) - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- setMethod(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- setName(String) - -Method in class org.owasp.esapi.tags.EncodeForHTMLAttributeTag -
- -
- setName(String) - -Method in class org.owasp.esapi.tags.EncodeForHTMLJavaScriptTag -
- -
- setName(String) - -Method in class org.owasp.esapi.tags.EncodeForHTMLTag -
- -
- setName(String) - -Method in class org.owasp.esapi.tags.EncodeForVBScriptTag -
- -
- setNoCacheHeaders(HttpServletResponse) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Set headers to protect sensitive information against being cached in the browser. -
- setNoCacheHeaders(HttpServletResponse) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- Set headers to protect sensitive information against being cached in the - browser. -
- setProperty(String, String) - -Method in interface org.owasp.esapi.EncryptedProperties -
- Encrypts the plaintext property value and stores the ciphertext value in the encrypted store. -
- setProperty(String, String) - -Method in class org.owasp.esapi.reference.DefaultEncryptedProperties -
- -
- setRandomizer(Randomizer) - -Static method in class org.owasp.esapi.ESAPI -
- -
- setRememberToken(HttpServletRequest, HttpServletResponse, String, int, String, String) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Set a cookie containing the current User's remember me token for automatic authentication. -
- setRememberToken(HttpServletRequest, HttpServletResponse, String, int, String, String) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- Save the user's remember me token in a cookie. -
- setRequestURI(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- setResourceDirectory(String) - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Sets the ESAPI resource directory. -
- setResourceDirectory(String) - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- -
- setRoles(Set) - -Method in interface org.owasp.esapi.User -
- Sets the roles of this account. -
- setRoles(Set) - -Method in class org.owasp.esapi.reference.DefaultUser -
- Sets the roles. -
- setScreenName(String) - -Method in interface org.owasp.esapi.User -
- Sets the screen name. -
- setScreenName(String) - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- setSecurityConfiguration(SecurityConfiguration) - -Static method in class org.owasp.esapi.ESAPI -
- -
- setStatus(int) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Override the status code with a 200 in order to confound attackers using - automated scanners. -
- setStatus(int, String) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Override the status code with a 200 in order to confound attackers using - automated scanners. -
- setStatus(int) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- setStatus(int, String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- setValidator(Validator) - -Static method in class org.owasp.esapi.ESAPI -
- -
- sign(String) - -Method in interface org.owasp.esapi.Encryptor -
- Create a digital signature for the provided data and return it in a - string. -
- sign(String) - -Method in class org.owasp.esapi.reference.JavaEncryptor -
- -
- size() - -Method in class org.owasp.esapi.ValidationErrorList -
- Returns the numbers of errors present. -
- store(OutputStream, String) - -Method in interface org.owasp.esapi.EncryptedProperties -
- Store. -
- store(OutputStream, String) - -Method in class org.owasp.esapi.reference.DefaultEncryptedProperties -
- Store. -
- stripControls(String) - -Static method in class org.owasp.esapi.StringUtilities -
- Removes all unprintable characters from a string - and replaces with a space for use in an HTTP header -
- suite() - -Static method in class org.owasp.esapi.AllTests -
- suite method automatically generated by JUnit module. -
- suite() - -Static method in class org.owasp.esapi.ESAPITest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.errors.EnterpriseSecurityExceptionTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.filters.ESAPIFilterTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.AccessControllerTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.AccessReferenceMapTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.AuthenticatorTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.EncoderTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.EncryptedPropertiesTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.EncryptorTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.ExecutorTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.HTTPUtilitiesTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.IntegerAccessReferenceMapTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.IntrusionDetectorTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.LoggerTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.RandomizerTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.SafeFileTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.UserTest -
- Suite. -
- suite() - -Static method in class org.owasp.esapi.reference.ValidatorTest -
- Suite. -
- suspendEncoding() - -Method in class org.owasp.esapi.codecs.Base64.OutputStream -
- Suspends encoding of the stream. -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-19.html b/javadoc/index-files/index-19.html deleted file mode 100644 index f7c5fdb17..000000000 --- a/javadoc/index-files/index-19.html +++ /dev/null @@ -1,618 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-T
--
-
- TestFilterChain - class org.owasp.esapi.http.TestFilterChain.
- TestFilterChain() - -Constructor for class org.owasp.esapi.http.TestFilterChain -
- -
- TestHttpServletRequest - class org.owasp.esapi.http.TestHttpServletRequest.
- The Class TestHttpServletRequest.
- TestHttpServletRequest() - -Constructor for class org.owasp.esapi.http.TestHttpServletRequest -
- -
- TestHttpServletRequest(String, byte[]) - -Constructor for class org.owasp.esapi.http.TestHttpServletRequest -
- -
- TestHttpServletResponse - class org.owasp.esapi.http.TestHttpServletResponse.
- The Class TestHttpServletResponse.
- TestHttpServletResponse() - -Constructor for class org.owasp.esapi.http.TestHttpServletResponse -
- -
- TestHttpSession - class org.owasp.esapi.http.TestHttpSession.
- The Class TestHttpSession.
- TestHttpSession() - -Constructor for class org.owasp.esapi.http.TestHttpSession -
- Instantiates a new test http session. -
- TestHttpSession(long, long) - -Constructor for class org.owasp.esapi.http.TestHttpSession -
- Instantiates a new test http session. -
- TestRequestDispatcher - class org.owasp.esapi.http.TestRequestDispatcher.
- TestRequestDispatcher() - -Constructor for class org.owasp.esapi.http.TestRequestDispatcher -
- -
- TestServletInputStream - class org.owasp.esapi.http.TestServletInputStream.
- TestServletInputStream(byte[]) - -Constructor for class org.owasp.esapi.http.TestServletInputStream -
- constructor -
- testAddCSRFToken() - -Method in class org.owasp.esapi.reference.HTTPUtilitiesTest -
- Test of addCSRFToken method, of class org.owasp.esapi.HTTPUtilities. -
- testAddDirectReference() - -Method in class org.owasp.esapi.reference.AccessReferenceMapTest -
- -
- testAddDirectReference() - -Method in class org.owasp.esapi.reference.IntegerAccessReferenceMapTest -
- -
- testAddEvent() - -Method in class org.owasp.esapi.reference.IntrusionDetectorTest -
- Test of addEvent method, of class org.owasp.esapi.IntrusionDetector. -
- testAddException() - -Method in class org.owasp.esapi.reference.IntrusionDetectorTest -
- Test of addException method, of class org.owasp.esapi.IntrusionDetector. -
- testAddRole() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of testAddRole method, of class org.owasp.esapi.User. -
- testAddRoles() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of addRoles method, of class org.owasp.esapi.User. -
- testAlternateDataStream() - -Method in class org.owasp.esapi.reference.SafeFileTest -
- -
- testCanonicalize() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of canonicalize method, of class org.owasp.esapi.Encoder. -
- testChangePassword() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of changePassword method, of class org.owasp.esapi.User. -
- testChangeSessionIdentifier() - -Method in class org.owasp.esapi.reference.HTTPUtilitiesTest -
- Test of sendRedirect method, of class org.owasp.esapi.HTTPUtilities. -
- testCreateSafeFile() - -Method in class org.owasp.esapi.reference.SafeFileTest -
- Test of executeOSCommand method, of class org.owasp.esapi.Executor -
- testCreateSafeFileParentConstructor() - -Method in class org.owasp.esapi.reference.SafeFileTest -
- -
- testCreateSafeFileURIConstructor() - -Method in class org.owasp.esapi.reference.SafeFileTest -
- -
- testCreateUser() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test of createAccount method, of class org.owasp.esapi.Authenticator. -
- testDebug() - -Method in class org.owasp.esapi.reference.LoggerTest -
- Test of logDebug method, of class org.owasp.esapi.Logger. -
- testDecodeFromBase64() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of decodeFromBase64 method, of class org.owasp.esapi.Encoder. -
- testDecodeFromURL() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of decodeFromURL method, of class org.owasp.esapi.Encoder. -
- testDecrypt() - -Method in class org.owasp.esapi.reference.EncryptorTest -
- Test of decrypt method, of class org.owasp.esapi.Encryptor. -
- testDisable() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of disable method, of class org.owasp.esapi.User. -
- testEnable() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of enable method, of class org.owasp.esapi.User. -
- testEncodeForBase64() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of encodeForBase64 method, of class org.owasp.esapi.Encoder. -
- testEncodeForCSS() - -Method in class org.owasp.esapi.reference.EncoderTest -
- -
- testEncodeForDN() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of encodeForLDAP method, of class org.owasp.esapi.Encoder. -
- testEncodeForHTML() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of encodeForHTML method, of class org.owasp.esapi.Encoder. -
- testEncodeForHTMLAttribute() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of encodeForHTMLAttribute method, of class org.owasp.esapi.Encoder. -
- testEncodeForJavascript() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of encodeForJavaScript method, of class org.owasp.esapi.Encoder. -
- testEncodeForLDAP() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of encodeForLDAP method, of class org.owasp.esapi.Encoder. -
- testEncodeForSQL() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of encodeForSQL method, of class org.owasp.esapi.Encoder. -
- testEncodeForURL() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of encodeForURL method, of class org.owasp.esapi.Encoder. -
- testEncodeForVBScript() - -Method in class org.owasp.esapi.reference.EncoderTest -
- -
- testEncodeForXML() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of encodeForXML method, of class org.owasp.esapi.Encoder. -
- testEncodeForXMLAttribute() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of encodeForXMLAttribute method, of class org.owasp.esapi.Encoder. -
- testEncodeForXPath() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of encodeForXPath method, of class org.owasp.esapi.Encoder. -
- testEncrypt() - -Method in class org.owasp.esapi.reference.EncryptorTest -
- Test of encrypt method, of class org.owasp.esapi.Encryptor. -
- testError() - -Method in class org.owasp.esapi.reference.LoggerTest -
- Test of logError method, of class org.owasp.esapi.Logger. -
- testExceptions() - -Method in class org.owasp.esapi.errors.EnterpriseSecurityExceptionTest -
- Test of update method, of class org.owasp.esapi.AccessReferenceMap. -
- testExecuteSystemCommand() - -Method in class org.owasp.esapi.reference.ExecutorTest -
- Test of executeOSCommand method, of class org.owasp.esapi.Executor -
- testExists() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test of exists method, of class org.owasp.esapi.Authenticator. -
- testFailedLoginLockout() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of failedLoginCount lockout, of class org.owasp.esapi.User. -
- testFatal() - -Method in class org.owasp.esapi.reference.LoggerTest -
- Test of logCritical method, of class org.owasp.esapi.Logger. -
- testFilter() - -Method in class org.owasp.esapi.filters.ESAPIFilterTest -
- Test of update method, of class org.owasp.esapi.AccessReferenceMap. -
- testGenerateStrongPassword() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test of generateStrongPassword method, of class - org.owasp.esapi.Authenticator. -
- testGetAccountName() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of getAccountName method, of class org.owasp.esapi.User. -
- testGetCurrentUser() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test of getCurrentUser method, of class org.owasp.esapi.Authenticator. -
- testGetDirectReference() - -Method in class org.owasp.esapi.reference.AccessReferenceMapTest -
- Test of getDirectReference method, of class - org.owasp.esapi.AccessReferenceMap. -
- testGetDirectReference() - -Method in class org.owasp.esapi.reference.IntegerAccessReferenceMapTest -
- Test of getDirectReference method, of class - org.owasp.esapi.AccessReferenceMap. -
- testGetFileUploads() - -Method in class org.owasp.esapi.reference.HTTPUtilitiesTest -
- Test of formatHttpRequestForLog method, of class org.owasp.esapi.HTTPUtilities. -
- testGetIndirectReference() - -Method in class org.owasp.esapi.reference.AccessReferenceMapTest -
- Test of getIndirectReference method, of class - org.owasp.esapi.AccessReferenceMap. -
- testGetIndirectReference() - -Method in class org.owasp.esapi.reference.IntegerAccessReferenceMapTest -
- Test of getIndirectReference method, of class - org.owasp.esapi.AccessReferenceMap. -
- testGetLastFailedLoginTime() - -Method in class org.owasp.esapi.reference.UserTest -
- Test get last failed login time. -
- testGetLastLoginTime() - -Method in class org.owasp.esapi.reference.UserTest -
- Test get last login time. -
- testGetLastPasswordChangeTime() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of getLastPasswordChangeTime method, of class org.owasp.esapi.User. -
- testGetProperty() - -Method in class org.owasp.esapi.reference.EncryptedPropertiesTest -
- Test of getProperty method, of class org.owasp.esapi.EncryptedProperties. -
- testGetRandomGUID() - -Method in class org.owasp.esapi.reference.RandomizerTest -
- Test of getRandomGUID method, of class org.owasp.esapi.Randomizer. -
- testGetRandomInteger() - -Method in class org.owasp.esapi.reference.RandomizerTest -
- Test of getRandomInteger method, of class org.owasp.esapi.Randomizer. -
- testGetRandomReal() - -Method in class org.owasp.esapi.reference.RandomizerTest -
- Test of getRandomReal method, of class org.owasp.esapi.Randomizer. -
- testGetRandomString() - -Method in class org.owasp.esapi.reference.RandomizerTest -
- Test of getRandomString method, of class org.owasp.esapi.Randomizer. -
- testGetRoles() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of getRoles method, of class org.owasp.esapi.User. -
- testGetScreenName() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of xxx method, of class org.owasp.esapi.User. -
- testGetStateFromEncryptedCookie() - -Method in class org.owasp.esapi.reference.HTTPUtilitiesTest -
- -
- testGetUser() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test of getUser method, of class org.owasp.esapi.Authenticator. -
- testGetUserFromRememberToken() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- -
- testGetUserFromSession() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test get user from session. -
- testGetUserNames() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test get user names. -
- testGetValidDate() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- Test of getValidDate method, of class org.owasp.esapi.Validator. -
- testGetValidSafeHTML() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- Test of getValidSafeHTML method, of class org.owasp.esapi.Validator. -
- testHash() - -Method in class org.owasp.esapi.reference.EncryptorTest -
- Test of hash method, of class org.owasp.esapi.Encryptor. -
- testHashPassword() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test of hashPassword method, of class org.owasp.esapi.Authenticator. -
- testIncrementFailedLoginCount() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of incrementFailedLoginCount method, of class org.owasp.esapi.User. -
- testInfo() - -Method in class org.owasp.esapi.reference.LoggerTest -
- Test of logSuccess method, of class org.owasp.esapi.Logger. -
- testIsAuthorizedForBackendService() - -Method in class org.owasp.esapi.reference.AccessControllerTest -
- Test of isAuthorizedForBackendService method, of class - org.owasp.esapi.AccessController. -
- testIsAuthorizedForData() - -Method in class org.owasp.esapi.reference.AccessControllerTest -
- Test of isAuthorizedForData method, of class - org.owasp.esapi.AccessController. -
- testIsAuthorizedForFile() - -Method in class org.owasp.esapi.reference.AccessControllerTest -
- Test of isAuthorizedForFile method, of class - org.owasp.esapi.AccessController. -
- testIsAuthorizedForFunction() - -Method in class org.owasp.esapi.reference.AccessControllerTest -
- Test of isAuthorizedForFunction method, of class - org.owasp.esapi.AccessController. -
- testIsAuthorizedForURL() - -Method in class org.owasp.esapi.reference.AccessControllerTest -
- Test of isAuthorizedForURL method, of class - org.owasp.esapi.AccessController. -
- testIsEnabled() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of isEnabled method, of class org.owasp.esapi.User. -
- testIsInRole() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of isInRole method, of class org.owasp.esapi.User. -
- testIsLocked() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of xxx method, of class org.owasp.esapi.User. -
- testIsSessionAbsoluteTimeout() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of isSessionAbsoluteTimeout method, of class - org.owasp.esapi.IntrusionDetector. -
- testIsSessionTimeout() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of isSessionTimeout method, of class - org.owasp.esapi.IntrusionDetector. -
- testIsValidCreditCard() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- Test of isValidCreditCard method, of class org.owasp.esapi.Validator. -
- testIsValidDirectoryPath() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- Test of isValidDirectoryPath method, of class org.owasp.esapi.Validator. -
- testIsValidFileContent() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- Test of isValidFileContent method, of class org.owasp.esapi.Validator. -
- testIsValidFileName() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- Test of isValidFileName method, of class org.owasp.esapi.Validator. -
- testIsValidFileUpload() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- Test of isValidFileUpload method, of class org.owasp.esapi.Validator. -
- testIsValidHTTPRequest() - -Method in class org.owasp.esapi.reference.HTTPUtilitiesTest -
- Test of isValidHTTPRequest method, of class org.owasp.esapi.HTTPUtilities. -
- testIsValidInteger() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- -
- testIsValidListItem() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- Test of isValidListItem method, of class org.owasp.esapi.Validator. -
- testIsValidNumber() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- Test of isValidNumber method, of class org.owasp.esapi.Validator. -
- testIsValidParameterSet() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- Test of isValidParameterSet method, of class org.owasp.esapi.Validator. -
- testIsValidPrintable() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- -
- testIsValidSafeHTML() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- Test of isValidSafeHTML method, of class org.owasp.esapi.Validator. -
- testIterator() - -Method in class org.owasp.esapi.reference.AccessReferenceMapTest -
- Test of iterator method, of class org.owasp.esapi.AccessReferenceMap. -
- testIterator() - -Method in class org.owasp.esapi.reference.IntegerAccessReferenceMapTest -
- Test of iterator method, of class org.owasp.esapi.AccessReferenceMap. -
- testJavaDirInjection() - -Method in class org.owasp.esapi.reference.SafeFileTest -
- -
- testJavaFileInjection() - -Method in class org.owasp.esapi.reference.SafeFileTest -
- -
- testKeySet() - -Method in class org.owasp.esapi.reference.EncryptedPropertiesTest -
- Test of keySet method, of class org.owasp.esapi.EncryptedProperties. -
- testKillAllCookies() - -Method in class org.owasp.esapi.reference.HTTPUtilitiesTest -
- Test of killAllCookies method, of class org.owasp.esapi.HTTPUtilities. -
- testKillCookie() - -Method in class org.owasp.esapi.reference.HTTPUtilitiesTest -
- Test of killCookie method, of class org.owasp.esapi.HTTPUtilities. -
- testLoad() - -Method in class org.owasp.esapi.reference.EncryptedPropertiesTest -
- Test of load method, of class org.owasp.esapi.EncryptedProperties. -
- testLock() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of lockAccount method, of class org.owasp.esapi.User. -
- testLogHTTPRequest() - -Method in class org.owasp.esapi.reference.LoggerTest -
- Test of logHTTPRequest method, of class org.owasp.esapi.Logger. -
- testLogin() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test of login method, of class org.owasp.esapi.Authenticator. -
- testLoginWithPassword() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of loginWithPassword method, of class org.owasp.esapi.User. -
- testLogout() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of logout method, of class org.owasp.esapi.User. -
- testMain() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test of main method, of class org.owasp.esapi.Authenticator. -
- testMain() - -Method in class org.owasp.esapi.reference.EncryptedPropertiesTest -
- Test of store method, of class org.owasp.esapi.EncryptedProperties. -
- testMatchRule() - -Method in class org.owasp.esapi.reference.AccessControllerTest -
- -
- testMultipleJavaFileInjection() - -Method in class org.owasp.esapi.reference.SafeFileTest -
- -
- testNormalPercentEncodedFileInjection() - -Method in class org.owasp.esapi.reference.SafeFileTest -
- -
- testNormalize() - -Method in class org.owasp.esapi.reference.EncoderTest -
- Test of normalize method, of class org.owasp.esapi.Validator. -
- testRemoveDirectReference() - -Method in class org.owasp.esapi.reference.AccessReferenceMapTest -
- -
- testRemoveDirectReference() - -Method in class org.owasp.esapi.reference.IntegerAccessReferenceMapTest -
- -
- testRemoveRole() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of testRemoveRole method, of class org.owasp.esapi.User. -
- testRemoveUser() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test of removeAccount method, of class org.owasp.esapi.Authenticator. -
- testResetCSRFToken() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of testResetCSRFToken method, of class org.owasp.esapi.User. -
- testSafeReadLine() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- Test safe read line. -
- testSaveStateInEncryptedCookie() - -Method in class org.owasp.esapi.reference.HTTPUtilitiesTest -
- -
- testSaveUsers() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test of saveUsers method, of class org.owasp.esapi.Authenticator. -
- testSeal() - -Method in class org.owasp.esapi.reference.EncryptorTest -
- Test of seal method, of class org.owasp.esapi.Encryptor. -
- testSendSafeRedirect() - -Method in class org.owasp.esapi.reference.HTTPUtilitiesTest -
- Test of sendRedirect method, of class org.owasp.esapi.HTTPUtilities. -
- testSetAccountName() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of setAccountName method, of class org.owasp.esapi.User. -
- testSetCookie() - -Method in class org.owasp.esapi.reference.HTTPUtilitiesTest -
- Test of setCookie method, of class org.owasp.esapi.HTTPUtilities. -
- testSetCurrentUser() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test of setCurrentUser method, of class org.owasp.esapi.Authenticator. -
- testSetCurrentUserWithRequest() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test of setCurrentUser method, of class org.owasp.esapi.Authenticator. -
- testSetExpirationTime() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of setExpirationTime method, of class org.owasp.esapi.User. -
- testSetNoCacheHeaders() - -Method in class org.owasp.esapi.reference.HTTPUtilitiesTest -
- Test set no cache headers. -
- testSetProperty() - -Method in class org.owasp.esapi.reference.EncryptedPropertiesTest -
- Test of setProperty method, of class org.owasp.esapi.EncryptedProperties. -
- testSetRememberToken() - -Method in class org.owasp.esapi.reference.HTTPUtilitiesTest -
- -
- testSetRoles() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of setRoles method, of class org.owasp.esapi.User. -
- testSetScreenName() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of setScreenName method, of class org.owasp.esapi.User. -
- testSetters() - -Method in class org.owasp.esapi.ESAPITest -
- Test of all the ESAPI setter methods -
- testSign() - -Method in class org.owasp.esapi.reference.EncryptorTest -
- Test of sign method, of class org.owasp.esapi.Encryptor. -
- testStore() - -Method in class org.owasp.esapi.reference.EncryptedPropertiesTest -
- Test of store method, of class org.owasp.esapi.EncryptedProperties. -
- testTrace() - -Method in class org.owasp.esapi.reference.LoggerTest -
- Test of logTrace method, of class org.owasp.esapi.Logger. -
- testUnlock() - -Method in class org.owasp.esapi.reference.UserTest -
- Test of unlockAccount method, of class org.owasp.esapi.User. -
- testUpdate() - -Method in class org.owasp.esapi.reference.AccessReferenceMapTest -
- Test of update method, of class org.owasp.esapi.AccessReferenceMap. -
- testUpdate() - -Method in class org.owasp.esapi.reference.IntegerAccessReferenceMapTest -
- Test of update method, of class org.owasp.esapi.AccessReferenceMap. -
- testValidatePasswordStrength() - -Method in class org.owasp.esapi.reference.AuthenticatorTest -
- Test of validatePasswordStrength method, of class - org.owasp.esapi.Authenticator. -
- testVerifySeal() - -Method in class org.owasp.esapi.reference.EncryptorTest -
- Test of verifySeal method, of class org.owasp.esapi.Encryptor. -
- testVerifySignature() - -Method in class org.owasp.esapi.reference.EncryptorTest -
- Test of verifySignature method, of class org.owasp.esapi.Encryptor. -
- testWarning() - -Method in class org.owasp.esapi.reference.LoggerTest -
- Test of logWarning method, of class org.owasp.esapi.Logger. -
- testWeirdPercentEncodedFileInjection() - -Method in class org.owasp.esapi.reference.SafeFileTest -
- -
- testisValidInput() - -Method in class org.owasp.esapi.reference.ValidatorTest -
- Test of isValidEmailAddress method, of class org.owasp.esapi.Validator. -
- toHex(byte) - -Static method in class org.owasp.esapi.reference.SafeFileTest -
- -
- toString() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- trace(String, String) - -Method in interface org.owasp.esapi.Logger -
- Log trace. -
- trace(String, String, Throwable) - -Method in interface org.owasp.esapi.Logger -
- Log trace. -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-2.html b/javadoc/index-files/index-2.html deleted file mode 100644 index d067834a1..000000000 --- a/javadoc/index-files/index-2.html +++ /dev/null @@ -1,152 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-B
--
-
- Base64 - class org.owasp.esapi.codecs.Base64.
- Encodes and decodes to and from Base64 notation.
- Base64.InputStream - class org.owasp.esapi.codecs.Base64.InputStream.
- A
Base64.InputStreamwill read data from another - java.io.InputStream, given in the constructor, - and encode/decode to/from Base64 notation on the fly. - Base64.InputStream(InputStream) - -Constructor for class org.owasp.esapi.codecs.Base64.InputStream -
- Constructs a
Base64.InputStreamin DECODE mode. - - Base64.InputStream(InputStream, int) - -Constructor for class org.owasp.esapi.codecs.Base64.InputStream -
- Constructs a
Base64.InputStreamin - either ENCODE or DECODE mode. - - Base64.OutputStream - class org.owasp.esapi.codecs.Base64.OutputStream.
- A
Base64.OutputStreamwill write data to another - java.io.OutputStream, given in the constructor, - and encode/decode to/from Base64 notation on the fly. - Base64.OutputStream(OutputStream) - -Constructor for class org.owasp.esapi.codecs.Base64.OutputStream -
- Constructs a
Base64.OutputStreamin ENCODE mode. - - Base64.OutputStream(OutputStream, int) - -Constructor for class org.owasp.esapi.codecs.Base64.OutputStream -
- Constructs a
Base64.OutputStreamin - either ENCODE or DECODE mode. -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-20.html b/javadoc/index-files/index-20.html deleted file mode 100644 index 4728f00e8..000000000 --- a/javadoc/index-files/index-20.html +++ /dev/null @@ -1,174 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-U
--
-
- URL_SAFE - -Static variable in class org.owasp.esapi.codecs.Base64 -
- Encode using Base64-like encoding that is URL- and Filename-safe as described - in Section 4 of RFC3548: - http://www.faqs.org/rfcs/rfc3548.html. -
- USABILITY - -Static variable in interface org.owasp.esapi.Logger -
- -
- User - interface org.owasp.esapi.User.
- The User interface represents an application user or user account.
- UserTest - class org.owasp.esapi.reference.UserTest.
- The Class UserTest.
- UserTest(String) - -Constructor for class org.owasp.esapi.reference.UserTest -
- Instantiates a new user test. -
- union(char[], char[]) - -Static method in class org.owasp.esapi.StringUtilities -
- Union two character arrays. -
- unlock() - -Method in interface org.owasp.esapi.User -
- Unlock account. -
- unlock() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- unseal(String) - -Method in interface org.owasp.esapi.Encryptor -
- Unseals data (created with the seal method) and throws an exception - describing any of the various problems that could exist with a seal, such - as an invalid seal format, expired timestamp, or decryption error. -
- unseal(String) - -Method in class org.owasp.esapi.reference.JavaEncryptor -
- -
- update(Set) - -Method in interface org.owasp.esapi.AccessReferenceMap -
- Updates the access reference map with a new set of directReferences, maintaining - any existing indirectReferences associated with items that are in the new list. -
- update(Set) - -Method in class org.owasp.esapi.reference.IntegerAccessReferenceMap -
- This preserves any existing mappings for items that are still in the new - list. -
- update(Set) - -Method in class org.owasp.esapi.reference.RandomAccessReferenceMap -
- This preserves any existing mappings for items that are still in the new - list. -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-21.html b/javadoc/index-files/index-21.html deleted file mode 100644 index 5fb27686d..000000000 --- a/javadoc/index-files/index-21.html +++ /dev/null @@ -1,221 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-V
--
-
- VBScriptCodec - class org.owasp.esapi.codecs.VBScriptCodec.
- Implementation of the Codec interface for 'quote' encoding from VBScript.
- VBScriptCodec() - -Constructor for class org.owasp.esapi.codecs.VBScriptCodec -
- -
- ValidationAvailabilityException - exception org.owasp.esapi.errors.ValidationAvailabilityException.
- ValidationAvailabilityException(String, String) - -Constructor for class org.owasp.esapi.errors.ValidationAvailabilityException -
- Create a new ValidationException -
- ValidationAvailabilityException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.ValidationAvailabilityException -
- Create a new ValidationException -
- ValidationErrorList - class org.owasp.esapi.ValidationErrorList.
- The ValidationErrorList class defines a well-formed collection of - ValidationExceptions so that groups of validation functions can be - called in a non-blocking fashion.
- ValidationErrorList() - -Constructor for class org.owasp.esapi.ValidationErrorList -
- -
- ValidationException - exception org.owasp.esapi.errors.ValidationException.
- A ValidationException should be thrown to indicate that the data provided by - the user or from some other external source does not match the validation - rules that have been specified for that data.
- ValidationException(String, String) - -Constructor for class org.owasp.esapi.errors.ValidationException -
- Creates a new instance of ValidationException. -
- ValidationException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.ValidationException -
- Instantiates a new ValidationException. -
- ValidationException(String, String, String) - -Constructor for class org.owasp.esapi.errors.ValidationException -
- Creates a new instance of ValidationException. -
- ValidationException(String, String, Throwable, String) - -Constructor for class org.owasp.esapi.errors.ValidationException -
- Instantiates a new ValidationException. -
- ValidationUploadException - exception org.owasp.esapi.errors.ValidationUploadException.
- ValidationUploadException(String, String) - -Constructor for class org.owasp.esapi.errors.ValidationUploadException -
- Create a new ValidationException -
- ValidationUploadException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.ValidationUploadException -
- Create a new ValidationException -
- Validator - interface org.owasp.esapi.Validator.
- The Validator interface defines a set of methods for canonicalizing and - validating untrusted input.
- ValidatorTest - class org.owasp.esapi.reference.ValidatorTest.
- The Class ValidatorTest.
- ValidatorTest(String) - -Constructor for class org.owasp.esapi.reference.ValidatorTest -
- Instantiates a new validator test. -
- validator() - -Static method in class org.owasp.esapi.ESAPI -
- -
- verifyAccountNameStrength(String) - -Method in interface org.owasp.esapi.Authenticator -
- Ensures that the account name passes site-specific complexity requirements, like minimum length. -
- verifyAccountNameStrength(String) - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- -
- verifyCSRFToken(HttpServletRequest) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Checks the CSRF token in the URL (see User.getCSRFToken()) against the user's CSRF token and - throws an IntrusionException if it is missing. -
- verifyCSRFToken(HttpServletRequest) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- verifyPassword(User, String) - -Method in interface org.owasp.esapi.Authenticator -
- Verify that the supplied password matches the password for this user. -
- verifyPassword(String) - -Method in interface org.owasp.esapi.User -
- Verify that the supplied password matches the password for this user. -
- verifyPassword(String) - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- verifyPassword(User, String) - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- -
- verifyPasswordStrength(String, String) - -Method in interface org.owasp.esapi.Authenticator -
- Ensures that the password meets site-specific complexity requirements. -
- verifyPasswordStrength(String, String) - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- -
- verifySeal(String) - -Method in interface org.owasp.esapi.Encryptor -
- Verifies a seal (created with the seal method) and throws an exception - describing any of the various problems that could exist with a seal, such - as an invalid seal format, expired timestamp, or data mismatch. -
- verifySeal(String) - -Method in class org.owasp.esapi.reference.JavaEncryptor -
- -
- verifySignature(String, String) - -Method in interface org.owasp.esapi.Encryptor -
- Verifies a digital signature (created with the sign method) and returns - the boolean result. -
- verifySignature(String, String) - -Method in class org.owasp.esapi.reference.JavaEncryptor -
- -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-22.html b/javadoc/index-files/index-22.html deleted file mode 100644 index d18f17048..000000000 --- a/javadoc/index-files/index-22.html +++ /dev/null @@ -1,148 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-W
--
-
- warning(String, String) - -Method in interface org.owasp.esapi.Logger -
- Log warning. -
- warning(String, String, Throwable) - -Method in interface org.owasp.esapi.Logger -
- Log warning. -
- write(int) - -Method in class org.owasp.esapi.codecs.Base64.OutputStream -
- Writes the byte to the output stream after - converting to/from Base64 notation. -
- write(byte[], int, int) - -Method in class org.owasp.esapi.codecs.Base64.OutputStream -
- Calls
Base64.OutputStream.write(int)repeatedly until len - bytes are written. -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-3.html b/javadoc/index-files/index-3.html deleted file mode 100644 index 99f9f3034..000000000 --- a/javadoc/index-files/index-3.html +++ /dev/null @@ -1,252 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-C
--
-
- CHAR_ALPHANUMERICS - -Static variable in interface org.owasp.esapi.Encoder -
- -
- CHAR_DIGITS - -Static variable in interface org.owasp.esapi.Encoder -
- -
- CHAR_LETTERS - -Static variable in interface org.owasp.esapi.Encoder -
- -
- CHAR_LOWERS - -Static variable in interface org.owasp.esapi.Encoder -
- Standard character sets -
- CHAR_PASSWORD_DIGITS - -Static variable in interface org.owasp.esapi.Encoder -
- -
- CHAR_PASSWORD_LETTERS - -Static variable in interface org.owasp.esapi.Encoder -
- -
- CHAR_PASSWORD_LOWERS - -Static variable in interface org.owasp.esapi.Encoder -
- Password character set, is alphanumerics (without l, i, I, o, O, and 0) - selected specials like + (bad for URL encoding, | is like i and 1, - etc...) -
- CHAR_PASSWORD_SPECIALS - -Static variable in interface org.owasp.esapi.Encoder -
- -
- CHAR_PASSWORD_UPPERS - -Static variable in interface org.owasp.esapi.Encoder -
- -
- CHAR_SPECIALS - -Static variable in interface org.owasp.esapi.Encoder -
- -
- CHAR_UPPERS - -Static variable in interface org.owasp.esapi.Encoder -
- -
- CSSCodec - class org.owasp.esapi.codecs.CSSCodec.
- Implementation of the Codec interface for backslash encoding frequently used in JavaScript.
- CSSCodec() - -Constructor for class org.owasp.esapi.codecs.CSSCodec -
- -
- CertificateException - exception org.owasp.esapi.errors.CertificateException.
- A CertificateException should be thrown for any problems that arise during - processing of digital certificates.
- CertificateException(String, String) - -Constructor for class org.owasp.esapi.errors.CertificateException -
- Creates a new instance of CertificateException. -
- CertificateException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.CertificateException -
- Instantiates a new CertificateException. -
- Codec - interface org.owasp.esapi.codecs.Codec.
- The Codec interface defines a set of methods for encoding and decoding application level encoding schemes, - such as HTML entity encoding and percent encoding (aka URL encoding).
- canonicalize(String) - -Method in interface org.owasp.esapi.Encoder -
- This method performs canonicalization on data received to ensure that it - has been reduced to its most basic form before validation. -
- canonicalize(String, boolean) - -Method in interface org.owasp.esapi.Encoder -
- -
- canonicalize(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- Simplifies encoded characters to their - simplest form so that they can be properly validated. -
- canonicalize(String, boolean) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- Strict mode throws an exception when any double encoded data is detected. -
- changePassword(User, String, String, String) - -Method in interface org.owasp.esapi.Authenticator -
- Changes the password for the specified user. -
- changePassword(String, String, String) - -Method in interface org.owasp.esapi.User -
- Sets the user's password, performing a verification of the user's old password, the equality of the two new - passwords, and the strength of the new password. -
- changePassword(String, String, String) - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- changePassword(User, String, String, String) - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- -
- changeSessionIdentifier(HttpServletRequest) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Invalidate the old session after copying all of its contents to a newly created session with a new session id. -
- changeSessionIdentifier(HttpServletRequest) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- clearCookies() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- clearCurrent() - -Method in interface org.owasp.esapi.Authenticator -
- Clear the current user. -
- clearCurrent() - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- Clears all threadlocal variables from the thread. -
- clone() - -Method in class org.owasp.esapi.reference.DefaultUser -
- Override clone and make final to prevent duplicate user objects. -
- close() - -Method in class org.owasp.esapi.codecs.Base64.OutputStream -
- Flushes and closes (I think, in the superclass) the stream. -
- contains(StringBuffer, char) - -Static method in class org.owasp.esapi.StringUtilities -
- Returns true if the character is contained in the provided StringBuffer. -
- containsHeader(String) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- containsHeader(String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- count - -Variable in class org.owasp.esapi.SecurityConfiguration.Threshold -
- -
- createUser(String, String, String) - -Method in interface org.owasp.esapi.Authenticator -
- Creates a new User with the information provided. -
- createUser(String, String, String) - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- -
- currentRequest() - -Static method in class org.owasp.esapi.ESAPI -
- -
- currentResponse() - -Static method in class org.owasp.esapi.ESAPI -
- -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-4.html b/javadoc/index-files/index-4.html deleted file mode 100644 index d5b29cbf1..000000000 --- a/javadoc/index-files/index-4.html +++ /dev/null @@ -1,340 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-D
--
-
- DECODE - -Static variable in class org.owasp.esapi.codecs.Base64 -
- Specify decoding. -
- DONT_BREAK_LINES - -Static variable in class org.owasp.esapi.codecs.Base64 -
- Don't break lines when encoding (violates strict Base64 specification) -
- DefaultEncoder - class org.owasp.esapi.reference.DefaultEncoder.
- Reference implementation of the Encoder interface.
- DefaultEncoder() - -Constructor for class org.owasp.esapi.reference.DefaultEncoder -
- -
- DefaultEncryptedProperties - class org.owasp.esapi.reference.DefaultEncryptedProperties.
- Reference implementation of the EncryptedProperties interface.
- DefaultEncryptedProperties() - -Constructor for class org.owasp.esapi.reference.DefaultEncryptedProperties -
- Instantiates a new encrypted properties. -
- DefaultExecutor - class org.owasp.esapi.reference.DefaultExecutor.
- Reference implementation of the Executor interface.
- DefaultExecutor() - -Constructor for class org.owasp.esapi.reference.DefaultExecutor -
- -
- DefaultHTTPUtilities - class org.owasp.esapi.reference.DefaultHTTPUtilities.
- Reference implementation of the HTTPUtilities interface.
- DefaultHTTPUtilities() - -Constructor for class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- DefaultIntrusionDetector - class org.owasp.esapi.reference.DefaultIntrusionDetector.
- Reference implementation of the IntrusionDetector interface.
- DefaultIntrusionDetector() - -Constructor for class org.owasp.esapi.reference.DefaultIntrusionDetector -
- -
- DefaultRandomizer - class org.owasp.esapi.reference.DefaultRandomizer.
- Reference implementation of the Randomizer interface.
- DefaultRandomizer() - -Constructor for class org.owasp.esapi.reference.DefaultRandomizer -
- Hide the constructor for the Singleton pattern. -
- DefaultSecurityConfiguration - class org.owasp.esapi.reference.DefaultSecurityConfiguration.
- The SecurityConfiguration manages all the settings used by the ESAPI in a single place.
- DefaultSecurityConfiguration() - -Constructor for class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Instantiates a new configuration. -
- DefaultUser - class org.owasp.esapi.reference.DefaultUser.
- Reference implementation of the User interface.
- DefaultValidator - class org.owasp.esapi.reference.DefaultValidator.
- Reference implementation of the Validator interface.
- DefaultValidator() - -Constructor for class org.owasp.esapi.reference.DefaultValidator -
- -
- debug(String, String) - -Method in interface org.owasp.esapi.Logger -
- Log debug. -
- debug(String, String, Throwable) - -Method in interface org.owasp.esapi.Logger -
- Log debug. -
- decode(byte[], int, int, int) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Very low-level access to decoding ASCII characters in - the form of a byte array. -
- decode(String) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Decodes data from Base64 notation, automatically - detecting gzip-compressed data and decompressing it. -
- decode(String, int) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Decodes data from Base64 notation, automatically - detecting gzip-compressed data and decompressing it. -
- decode(String) - -Method in class org.owasp.esapi.codecs.CSSCodec -
- -
- decode(String) - -Method in interface org.owasp.esapi.codecs.Codec -
- -
- decode(String) - -Method in class org.owasp.esapi.codecs.HTMLEntityCodec -
- -
- decode(String) - -Method in class org.owasp.esapi.codecs.JavaScriptCodec -
- -
- decode(String) - -Method in class org.owasp.esapi.codecs.MySQLCodec -
- -
- decode(String) - -Method in class org.owasp.esapi.codecs.OracleCodec -
- -
- decode(String) - -Method in class org.owasp.esapi.codecs.PercentCodec -
- -
- decode(String) - -Method in class org.owasp.esapi.codecs.VBScriptCodec -
- -
- decodeCharacter(PushbackString) - -Method in class org.owasp.esapi.codecs.CSSCodec -
- Returns the decoded version of the character starting at index, or - null if no decoding is possible. -
- decodeCharacter(PushbackString) - -Method in interface org.owasp.esapi.codecs.Codec -
- Returns the decoded version of the next character from the input string and advances the - current character in the PushbackString. -
- decodeCharacter(PushbackString) - -Method in class org.owasp.esapi.codecs.HTMLEntityCodec -
- Returns the decoded version of the character starting at index, or - null if no decoding is possible. -
- decodeCharacter(PushbackString) - -Method in class org.owasp.esapi.codecs.JavaScriptCodec -
- Returns the decoded version of the character starting at index, or - null if no decoding is possible. -
- decodeCharacter(PushbackString) - -Method in class org.owasp.esapi.codecs.MySQLCodec -
- Returns the decoded version of the character starting at index, or - null if no decoding is possible. -
- decodeCharacter(PushbackString) - -Method in class org.owasp.esapi.codecs.OracleCodec -
- Returns the decoded version of the character starting at index, or - null if no decoding is possible. -
- decodeCharacter(PushbackString) - -Method in class org.owasp.esapi.codecs.PercentCodec -
- Returns the decoded version of the character starting at index, or - null if no decoding is possible. -
- decodeCharacter(PushbackString) - -Method in class org.owasp.esapi.codecs.VBScriptCodec -
- Returns the decoded version of the character starting at index, or - null if no decoding is possible. -
- decodeFileToFile(String, String) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Reads infile and decodes it to outfile. -
- decodeFromBase64(String) - -Method in interface org.owasp.esapi.Encoder -
- Decode data encoded with BASE-64 encoding. -
- decodeFromBase64(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- -
- decodeFromFile(String) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Convenience method for reading a base64-encoded - file and decoding it. -
- decodeFromURL(String) - -Method in interface org.owasp.esapi.Encoder -
- Decode from URL. -
- decodeFromURL(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- -
- decodeToFile(String, String) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Convenience method for decoding data to a file. -
- decodeToObject(String) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Attempts to decode Base64 data and deserialize a Java - Object within. -
- decrypt(String) - -Method in interface org.owasp.esapi.Encryptor -
- Decrypts the provided ciphertext string (encrypted with the encrypt - method) and returns a plaintext string. -
- decrypt(String) - -Method in class org.owasp.esapi.reference.JavaEncryptor -
- -
- decryptHiddenField(String) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Decrypts an encrypted hidden field value and returns the cleartext. -
- decryptHiddenField(String) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- decryptQueryString(String) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Takes an encrypted querystring and returns a Map containing the original parameters. -
- decryptQueryString(String) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- decryptStateFromCookie(HttpServletRequest) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Retrieves a map of data from a cookie encrypted with encryptStateInCookie(). -
- decryptStateFromCookie(HttpServletRequest) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- destroy() - -Method in class org.owasp.esapi.filters.ESAPIFilter -
- Called by the web container to indicate to a filter that it is being - taken out of service. -
- destroy() - -Method in class org.owasp.esapi.filters.SafeHTTPFilter -
- -
- disable() - -Method in interface org.owasp.esapi.User -
- Disable account. -
- disable() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- doAfterBody() - -Method in class org.owasp.esapi.tags.EncodeForHTMLAttributeTag -
- -
- doAfterBody() - -Method in class org.owasp.esapi.tags.EncodeForHTMLJavaScriptTag -
- -
- doAfterBody() - -Method in class org.owasp.esapi.tags.EncodeForHTMLTag -
- -
- doAfterBody() - -Method in class org.owasp.esapi.tags.EncodeForVBScriptTag -
- -
- doEndTag() - -Method in class org.owasp.esapi.tags.EncodeForVBScriptTag -
- -
- doFilter(ServletRequest, ServletResponse, FilterChain) - -Method in class org.owasp.esapi.filters.ESAPIFilter -
- The doFilter method of the Filter is called by the container each time a - request/response pair is passed through the chain due to a client request - for a resource at the end of the chain. -
- doFilter(ServletRequest, ServletResponse, FilterChain) - -Method in class org.owasp.esapi.filters.SafeHTTPFilter -
- -
- doFilter(ServletRequest, ServletResponse) - -Method in class org.owasp.esapi.http.TestFilterChain -
- -
- doStartTag() - -Method in class org.owasp.esapi.tags.EncodeForHTMLAttributeTag -
- -
- doStartTag() - -Method in class org.owasp.esapi.tags.EncodeForHTMLJavaScriptTag -
- -
- doStartTag() - -Method in class org.owasp.esapi.tags.EncodeForHTMLTag -
- -
- doStartTag() - -Method in class org.owasp.esapi.tags.EncodeForVBScriptTag -
- -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-5.html b/javadoc/index-files/index-5.html deleted file mode 100644 index 41d97bd65..000000000 --- a/javadoc/index-files/index-5.html +++ /dev/null @@ -1,453 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-E
--
-
- ENCODE - -Static variable in class org.owasp.esapi.codecs.Base64 -
- Specify encoding. -
- ESAPI - class org.owasp.esapi.ESAPI.
- ESAPI locator class to make it easy to get a concrete implementation of the - various ESAPI classes.
- ESAPIFilter - class org.owasp.esapi.filters.ESAPIFilter.
- ESAPIFilter() - -Constructor for class org.owasp.esapi.filters.ESAPIFilter -
- -
- ESAPIFilterTest - class org.owasp.esapi.filters.ESAPIFilterTest.
- The Class AccessReferenceMapTest.
- ESAPIFilterTest(String) - -Constructor for class org.owasp.esapi.filters.ESAPIFilterTest -
- Instantiates a new access reference map test. -
- ESAPITest - class org.owasp.esapi.ESAPITest.
- The Class ExecutorTest.
- ESAPITest(String) - -Constructor for class org.owasp.esapi.ESAPITest -
- Instantiates a new executor test. -
- EncodeForHTMLAttributeTag - class org.owasp.esapi.tags.EncodeForHTMLAttributeTag.
- EncodeForHTMLAttributeTag() - -Constructor for class org.owasp.esapi.tags.EncodeForHTMLAttributeTag -
- -
- EncodeForHTMLJavaScriptTag - class org.owasp.esapi.tags.EncodeForHTMLJavaScriptTag.
- EncodeForHTMLJavaScriptTag() - -Constructor for class org.owasp.esapi.tags.EncodeForHTMLJavaScriptTag -
- -
- EncodeForHTMLTag - class org.owasp.esapi.tags.EncodeForHTMLTag.
- EncodeForHTMLTag() - -Constructor for class org.owasp.esapi.tags.EncodeForHTMLTag -
- -
- EncodeForVBScriptTag - class org.owasp.esapi.tags.EncodeForVBScriptTag.
- EncodeForVBScriptTag() - -Constructor for class org.owasp.esapi.tags.EncodeForVBScriptTag -
- -
- Encoder - interface org.owasp.esapi.Encoder.
- The Encoder interface contains a number of methods related to encoding input - so that it will be safe for a variety of interpreters.
- EncoderTest - class org.owasp.esapi.reference.EncoderTest.
- The Class EncoderTest.
- EncoderTest(String) - -Constructor for class org.owasp.esapi.reference.EncoderTest -
- Instantiates a new encoder test. -
- EncodingException - exception org.owasp.esapi.errors.EncodingException.
- An ExecutorException should be thrown for any problems that occur when - encoding or decoding data.
- EncodingException(String, String) - -Constructor for class org.owasp.esapi.errors.EncodingException -
- Creates a new instance of EncodingException. -
- EncodingException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.EncodingException -
- Instantiates a new EncodingException. -
- EncryptedProperties - interface org.owasp.esapi.EncryptedProperties.
- The EncryptedProperties interface represents a properties file where all the data is - encrypted before it is added, and decrypted when it retrieved.
- EncryptedPropertiesTest - class org.owasp.esapi.reference.EncryptedPropertiesTest.
- The Class EncryptedPropertiesTest.
- EncryptedPropertiesTest(String) - -Constructor for class org.owasp.esapi.reference.EncryptedPropertiesTest -
- Instantiates a new encrypted properties test. -
- EncryptionException - exception org.owasp.esapi.errors.EncryptionException.
- An EncryptionException should be thrown for any problems related to - encryption, hashing, or digital signatures.
- EncryptionException(String, String) - -Constructor for class org.owasp.esapi.errors.EncryptionException -
- Creates a new instance of EncryptionException. -
- EncryptionException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.EncryptionException -
- Instantiates a new EncryptionException. -
- Encryptor - interface org.owasp.esapi.Encryptor.
- The Encryptor interface provides a set of methods for performing common - encryption, random number, and hashing operations.
- EncryptorTest - class org.owasp.esapi.reference.EncryptorTest.
- The Class EncryptorTest.
- EncryptorTest(String) - -Constructor for class org.owasp.esapi.reference.EncryptorTest -
- Instantiates a new encryptor test. -
- EnterpriseSecurityException - exception org.owasp.esapi.errors.EnterpriseSecurityException.
- EnterpriseSecurityException is the base class for all security related exceptions.
- EnterpriseSecurityException(String, String) - -Constructor for class org.owasp.esapi.errors.EnterpriseSecurityException -
- Creates a new instance of EnterpriseSecurityException. -
- EnterpriseSecurityException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.EnterpriseSecurityException -
- Creates a new instance of EnterpriseSecurityException that includes a root cause Throwable. -
- EnterpriseSecurityExceptionTest - class org.owasp.esapi.errors.EnterpriseSecurityExceptionTest.
- The Class AccessReferenceMapTest.
- EnterpriseSecurityExceptionTest(String) - -Constructor for class org.owasp.esapi.errors.EnterpriseSecurityExceptionTest -
- Instantiates a new access reference map test. -
- Executor - interface org.owasp.esapi.Executor.
- The Executor interface is used to run an OS command with reduced security risk.
- ExecutorException - exception org.owasp.esapi.errors.ExecutorException.
- An ExecutorException should be thrown for any problems that arise during the - execution of a system executable.
- ExecutorException(String, String) - -Constructor for class org.owasp.esapi.errors.ExecutorException -
- Creates a new instance of ExecutorException. -
- ExecutorException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.ExecutorException -
- Instantiates a new ExecutorException. -
- ExecutorTest - class org.owasp.esapi.reference.ExecutorTest.
- The Class ExecutorTest.
- ExecutorTest(String) - -Constructor for class org.owasp.esapi.reference.ExecutorTest -
- Instantiates a new executor test. -
- enable() - -Method in interface org.owasp.esapi.User -
- Enable account. -
- enable() - -Method in class org.owasp.esapi.reference.DefaultUser -
- Enable the account -
- encode(String) - -Method in class org.owasp.esapi.codecs.CSSCodec -
- -
- encode(String) - -Method in interface org.owasp.esapi.codecs.Codec -
- -
- encode(String) - -Method in class org.owasp.esapi.codecs.HTMLEntityCodec -
- -
- encode(String) - -Method in class org.owasp.esapi.codecs.JavaScriptCodec -
- -
- encode(String) - -Method in class org.owasp.esapi.codecs.MySQLCodec -
- -
- encode(String) - -Method in class org.owasp.esapi.codecs.OracleCodec -
- -
- encode(String) - -Method in class org.owasp.esapi.codecs.PercentCodec -
- -
- encode(String) - -Method in class org.owasp.esapi.codecs.VBScriptCodec -
- -
- encodeBytes(byte[]) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Encodes a byte array into Base64 notation. -
- encodeBytes(byte[], int) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Encodes a byte array into Base64 notation. -
- encodeBytes(byte[], int, int) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Encodes a byte array into Base64 notation. -
- encodeBytes(byte[], int, int, int) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Encodes a byte array into Base64 notation. -
- encodeCharacter(Character) - -Method in class org.owasp.esapi.codecs.CSSCodec -
- Returns backslash encoded character. -
- encodeCharacter(Character) - -Method in interface org.owasp.esapi.codecs.Codec -
- -
- encodeCharacter(Character) - -Method in class org.owasp.esapi.codecs.HTMLEntityCodec -
- -
- encodeCharacter(Character) - -Method in class org.owasp.esapi.codecs.JavaScriptCodec -
- Returns backslash encoded character. -
- encodeCharacter(Character) - -Method in class org.owasp.esapi.codecs.MySQLCodec -
- Returns quote-encoded character -
- encodeCharacter(Character) - -Method in class org.owasp.esapi.codecs.OracleCodec -
- Returns quote-encoded character -
- encodeCharacter(Character) - -Method in class org.owasp.esapi.codecs.PercentCodec -
- -
- encodeCharacter(Character) - -Method in class org.owasp.esapi.codecs.VBScriptCodec -
- Returns quote-encoded character -
- encodeFileToFile(String, String) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Reads infile and encodes it to outfile. -
- encodeForBase64(byte[], boolean) - -Method in interface org.owasp.esapi.Encoder -
- Encode for Base64. -
- encodeForBase64(byte[], boolean) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- -
- encodeForCSS(String) - -Method in interface org.owasp.esapi.Encoder -
- Encode data for use in Cascading Style Sheets (CSS) content. -
- encodeForCSS(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- http://www.w3.org/TR/CSS21/syndata.html#escaped-characters -
- encodeForDN(String) - -Method in interface org.owasp.esapi.Encoder -
- Encode data for use in an LDAP distinguished name. -
- encodeForDN(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- -
- encodeForHTML(String) - -Method in interface org.owasp.esapi.Encoder -
- Encode data for use in HTML content. -
- encodeForHTML(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- Encode the input string using HTML entity encoding. -
- encodeForHTMLAttribute(String) - -Method in interface org.owasp.esapi.Encoder -
- Encode data for use in HTML attributes. -
- encodeForHTMLAttribute(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- -
- encodeForJavaScript(String) - -Method in interface org.owasp.esapi.Encoder -
- Encode data for insertion inside a data value in JavaScript. -
- encodeForJavaScript(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- -
- encodeForLDAP(String) - -Method in interface org.owasp.esapi.Encoder -
- Encode data for use in LDAP queries. -
- encodeForLDAP(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- -
- encodeForSQL(Codec, String) - -Method in interface org.owasp.esapi.Encoder -
- Encode for SQL according to the selected codec. -
- encodeForSQL(Codec, String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- This method is not recommended. -
- encodeForURL(String) - -Method in interface org.owasp.esapi.Encoder -
- Encode for use in a URL. -
- encodeForURL(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- -
- encodeForVBScript(String) - -Method in interface org.owasp.esapi.Encoder -
- Encode data for insertion inside a data value in a visual basic script. -
- encodeForVBScript(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- -
- encodeForXML(String) - -Method in interface org.owasp.esapi.Encoder -
- Encode data for use in an XML element. -
- encodeForXML(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- -
- encodeForXMLAttribute(String) - -Method in interface org.owasp.esapi.Encoder -
- Encode data for use in an XML attribute. -
- encodeForXMLAttribute(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- -
- encodeForXPath(String) - -Method in interface org.owasp.esapi.Encoder -
- Encode data for use in an XPath query. -
- encodeForXPath(String) - -Method in class org.owasp.esapi.reference.DefaultEncoder -
- This implementation encodes almost everything and may overencode. -
- encodeFromFile(String) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Convenience method for reading a binary file - and base64-encoding it. -
- encodeObject(Serializable) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Serializes an object and returns the Base64-encoded - version of that serialized object. -
- encodeObject(Serializable, int) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Serializes an object and returns the Base64-encoded - version of that serialized object. -
- encodeRedirectURL(String) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Return the URL without any changes, to prevent disclosure of the - JSESSIONID The default implementation of this method can add the - JSESSIONID to the URL if support for cookies is not detected. -
- encodeRedirectURL(String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- encodeRedirectUrl(String) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Return the URL without any changes, to prevent disclosure of the - JSESSIONID. -
- encodeRedirectUrl(String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- encodeToFile(byte[], String) - -Static method in class org.owasp.esapi.codecs.Base64 -
- Convenience method for encoding data to a file. -
- encodeURL(String) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Return the URL without any changes, to prevent disclosure of the - JSESSIONID The default implementation of this method can add the - JSESSIONID to the URL if support for cookies is not detected. -
- encodeURL(String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- encodeUrl(String) - -Method in class org.owasp.esapi.filters.SafeResponse -
- Return the URL without any changes, to prevent disclosure of the - JSESSIONID The default implementation of this method can add the - JSESSIONID to the URL if support for cookies is not detected. -
- encodeUrl(String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- encoder() - -Static method in class org.owasp.esapi.ESAPI -
- -
- encrypt(String) - -Method in interface org.owasp.esapi.Encryptor -
- Encrypts the provided plaintext and returns a ciphertext string. -
- encrypt(String) - -Method in class org.owasp.esapi.reference.JavaEncryptor -
- -
- encryptHiddenField(String) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Encrypts a hidden field value for use in HTML. -
- encryptHiddenField(String) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- encryptQueryString(String) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Takes a querystring (i.e. -
- encryptQueryString(String) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- encryptStateInCookie(HttpServletResponse, Map) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Stores a Map of data in an encrypted cookie. -
- encryptStateInCookie(HttpServletResponse, Map) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- encryptor() - -Static method in class org.owasp.esapi.ESAPI -
- -
- error(String, String) - -Method in interface org.owasp.esapi.Logger -
- Log error. -
- error(String, String, Throwable) - -Method in interface org.owasp.esapi.Logger -
- Log error. -
- errors() - -Method in class org.owasp.esapi.ValidationErrorList -
- Returns list of ValidationException, or empty list of no errors exist. -
- executeSystemCommand(File, List, File, int) - -Method in interface org.owasp.esapi.Executor -
- Executes a system command after checking that the executable exists and - that the parameters have not been subject to injection with untrusted - user data. -
- executeSystemCommand(File, List, File, int) - -Method in class org.owasp.esapi.reference.DefaultExecutor -
- -
- executor() - -Static method in class org.owasp.esapi.ESAPI -
- -
- exists(String) - -Method in interface org.owasp.esapi.Authenticator -
- Determine if the account exists. -
- exists(String) - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-6.html b/javadoc/index-files/index-6.html deleted file mode 100644 index 84215fcf7..000000000 --- a/javadoc/index-files/index-6.html +++ /dev/null @@ -1,161 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-F
--
-
- FUNCTIONALITY - -Static variable in interface org.owasp.esapi.Logger -
- -
- FileBasedAccessController - class org.owasp.esapi.reference.FileBasedAccessController.
- Reference implementation of the AccessController interface.
- FileBasedAccessController() - -Constructor for class org.owasp.esapi.reference.FileBasedAccessController -
- -
- FileBasedAuthenticator - class org.owasp.esapi.reference.FileBasedAuthenticator.
- Reference implementation of the Authenticator interface.
- FileBasedAuthenticator() - -Constructor for class org.owasp.esapi.reference.FileBasedAuthenticator -
- -
- fatal(String, String) - -Method in interface org.owasp.esapi.Logger -
- Log critical. -
- fatal(String, String, Throwable) - -Method in interface org.owasp.esapi.Logger -
- Log critical. -
- flushBase64() - -Method in class org.owasp.esapi.codecs.Base64.OutputStream -
- Method added by PHIL. -
- flushBuffer() - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- flushBuffer() - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- forward(ServletRequest, ServletResponse) - -Method in class org.owasp.esapi.http.TestRequestDispatcher -
- -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-7.html b/javadoc/index-files/index-7.html deleted file mode 100644 index a04e2aaae..000000000 --- a/javadoc/index-files/index-7.html +++ /dev/null @@ -1,1075 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-G
--
-
- GZIP - -Static variable in class org.owasp.esapi.codecs.Base64 -
- Specify that data should be gzip-compressed. -
- generateStrongPassword() - -Method in interface org.owasp.esapi.Authenticator -
- Generate a strong password. -
- generateStrongPassword(User, String) - -Method in interface org.owasp.esapi.Authenticator -
- Generate strong password that takes into account the user's information and old password. -
- generateStrongPassword() - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- -
- generateStrongPassword(User, String) - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- -
- getAccountId() - -Method in interface org.owasp.esapi.User -
- Gets the account id. -
- getAccountId() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- getAccountName() - -Method in interface org.owasp.esapi.User -
- Gets the account name. -
- getAccountName() - -Method in class org.owasp.esapi.reference.DefaultUser -
- Gets the account name. -
- getAllowedFileExtensions() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the allowed file extensions. -
- getAllowedFileExtensions() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the allowed file extensions. -
- getAllowedFileUploadSize() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the allowed file upload size. -
- getAllowedFileUploadSize() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the allowed file upload size. -
- getAllowedLoginAttempts() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the allowed login attempts. -
- getAllowedLoginAttempts() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the allowed login attempts. -
- getApplicationName() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the application name, used for logging -
- getApplicationName() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- -
- getAttribute(String) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getAttribute(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getAttribute(String) - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- getAttributeNames() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getAttributeNames() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getAttributeNames() - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- getAuthType() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getAuthType() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getBufferSize() - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- getBufferSize() - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- getCSRFToken() - -Method in interface org.owasp.esapi.HTTPUtilities -
- Returns the current user's CSRF token. -
- getCSRFToken() - -Method in interface org.owasp.esapi.User -
- Gets the CSRF token. -
- getCSRFToken() - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- getCSRFToken() - -Method in class org.owasp.esapi.reference.DefaultUser -
- Gets the CSRF token. -
- getCharacterEncoding() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the character encoding. -
- getCharacterEncoding() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getCharacterEncoding() - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- getCharacterEncoding() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getCharacterEncoding() - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- getCharacterEncoding() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the character encoding. -
- getContentLength() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getContentLength() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getContentType() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getContentType() - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- getContentType() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getContentType() - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- getContext() - -Method in class org.owasp.esapi.errors.ValidationException -
- Returns the UI reference that caused this ValidationException -
- getContextPath() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the context path from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getContextPath() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getCookie(HttpServletRequest, String) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Get the first cookie with the matching name. -
- getCookie(String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- getCookie(HttpServletRequest, String) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- Returns the first cookie matching the provided name. -
- getCookies() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the array of Cookies from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getCookies() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getCookies() - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- Gets the cookies. -
- getCreationTime() - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- getCurrentRequest() - -Method in interface org.owasp.esapi.HTTPUtilities -
- Retrieves the current HttpServletRequest -
- getCurrentRequest() - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- getCurrentResponse() - -Method in interface org.owasp.esapi.HTTPUtilities -
- Retrieves the current HttpServletResponse -
- getCurrentResponse() - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- -
- getCurrentUser() - -Method in interface org.owasp.esapi.Authenticator -
- Returns the currently logged in User. -
- getCurrentUser() - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- -
- getDateHeader(String) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getDateHeader(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getDigitalSignatureAlgorithm() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the digital signature algorithm. -
- getDigitalSignatureAlgorithm() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the digital signature algorithm. -
- getDirectReference(String) - -Method in interface org.owasp.esapi.AccessReferenceMap -
- Get the original direct object reference from an indirect reference. -
- getDirectReference(String) - -Method in class org.owasp.esapi.reference.IntegerAccessReferenceMap -
- -
- getDirectReference(String) - -Method in class org.owasp.esapi.reference.RandomAccessReferenceMap -
- -
- getEncryptionAlgorithm() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the encryption algorithm. -
- getEncryptionAlgorithm() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the encryption algorithm. -
- getError(String) - -Method in class org.owasp.esapi.ValidationErrorList -
- Retrieves ValidationException for given context if one exists. -
- getExpirationTime() - -Method in interface org.owasp.esapi.User -
- Returns the date that the current user's account will expire, usually when the account will be disabled. -
- getExpirationTime() - -Method in class org.owasp.esapi.reference.DefaultUser -
- Gets the expiration time. -
- getFailedLoginCount() - -Method in interface org.owasp.esapi.User -
- Returns the number of failed login attempts since the last successful login for an account. -
- getFailedLoginCount() - -Method in class org.owasp.esapi.reference.DefaultUser -
- Gets the failed login count. -
- getHashAlgorithm() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the hashing algorithm. -
- getHashAlgorithm() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the hasing algorithm. -
- getHeader(String) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the named header from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getHeader(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getHeader(String) - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- Gets the header. -
- getHeaderNames() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the enumeration of header names from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getHeaderNames() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getHeaderNames() - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- Gets the header names. -
- getHeaders(String) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the enumeration of headers from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getHeaders(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getId() - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- getIndirectReference(Object) - -Method in interface org.owasp.esapi.AccessReferenceMap -
- Get a safe indirect reference to use in place of a potentially sensitive - direct object reference. -
- getIndirectReference(Object) - -Method in class org.owasp.esapi.reference.IntegerAccessReferenceMap -
- -
- getIndirectReference(Object) - -Method in class org.owasp.esapi.reference.RandomAccessReferenceMap -
- -
- getInputStream() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getInputStream() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getIntHeader(String) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getIntHeader(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getInvalidated() - -Method in class org.owasp.esapi.http.TestHttpSession -
- Gets the invalidated. -
- getKeystore() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the keystore. -
- getKeystore() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the keystore. -
- getLastAccessedTime() - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- getLastFailedLoginTime() - -Method in interface org.owasp.esapi.User -
- Returns the date of the last failed login time for a user. -
- getLastFailedLoginTime() - -Method in class org.owasp.esapi.reference.DefaultUser -
- Gets the last failed login time. -
- getLastHostAddress() - -Method in interface org.owasp.esapi.User -
- Returns the last host address used by the user. -
- getLastHostAddress() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- getLastLoginTime() - -Method in interface org.owasp.esapi.User -
- Returns the date of the last successful login time for a user. -
- getLastLoginTime() - -Method in class org.owasp.esapi.reference.DefaultUser -
- Gets the last login time. -
- getLastPasswordChangeTime() - -Method in interface org.owasp.esapi.User -
- Gets the date of user's last password change. -
- getLastPasswordChangeTime() - -Method in class org.owasp.esapi.reference.DefaultUser -
- Gets the last password change time. -
- getLocalAddr() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getLocalAddr() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getLocalName() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getLocalName() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getLocalPort() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getLocalPort() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getLocale() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getLocale() - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- getLocale() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getLocale() - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- getLocales() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getLocales() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getLogEncodingRequired() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Returns whether HTML entity encoding should be applied to log entries. -
- getLogEncodingRequired() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- -
- getLogLevel() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- -
- getLogMessage() - -Method in class org.owasp.esapi.errors.EnterpriseSecurityException -
- -
- getLogMessage() - -Method in class org.owasp.esapi.errors.IntrusionException -
- -
- getLogger(Class) - -Static method in class org.owasp.esapi.ESAPI -
- -
- getLogger(String) - -Static method in class org.owasp.esapi.ESAPI -
- -
- getLogger(String) - -Method in interface org.owasp.esapi.LogFactory -
- -
- getLogger(Class) - -Method in interface org.owasp.esapi.LogFactory -
- -
- getLogger(Class) - -Method in class org.owasp.esapi.reference.JavaLogFactory -
- -
- getLogger(String) - -Method in class org.owasp.esapi.reference.JavaLogFactory -
- -
- getMasterPassword() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the master password. -
- getMasterPassword() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the master password. -
- getMasterSalt() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the master salt. -
- getMasterSalt() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the master salt. -
- getMaxInactiveInterval() - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- getMaxOldPasswordHashes() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the max old password hashes. -
- getMaxOldPasswordHashes() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the max old password hashes. -
- getMethod() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getMethod() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getName() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- getName() - -Method in class org.owasp.esapi.tags.EncodeForHTMLAttributeTag -
- -
- getName() - -Method in class org.owasp.esapi.tags.EncodeForHTMLJavaScriptTag -
- -
- getName() - -Method in class org.owasp.esapi.tags.EncodeForHTMLTag -
- -
- getName() - -Method in class org.owasp.esapi.tags.EncodeForVBScriptTag -
- -
- getOutputStream() - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- getOutputStream() - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- getParameter(String) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the named parameter from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getParameter(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getParameterMap() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the parameter map from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getParameterMap() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getParameterNames() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the enumeration of parameter names from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getParameterNames() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getParameterValues(String) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the array of matching parameter values from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getParameterValues(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getPasswordParameterName() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the password parameter name. -
- getPasswordParameterName() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the password parameter name. -
- getPathInfo() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the path info from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getPathInfo() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getPathTranslated() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getPathTranslated() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getProperty(String) - -Method in interface org.owasp.esapi.EncryptedProperties -
- Gets the property value from the encrypted store, decrypts it, and returns the plaintext value to the caller. -
- getProperty(String) - -Method in class org.owasp.esapi.reference.DefaultEncryptedProperties -
- -
- getProtocol() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getProtocol() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getQueryString() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the query string from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getQueryString() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getQuota(String) - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets an intrusion detection Quota. -
- getQuota(String) - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- -
- getRandomAlgorithm() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the random number generation algorithm. -
- getRandomAlgorithm() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the random number generation algorithm. -
- getRandomBoolean() - -Method in interface org.owasp.esapi.Randomizer -
- Returns a random boolean. -
- getRandomBoolean() - -Method in class org.owasp.esapi.reference.DefaultRandomizer -
- -
- getRandomFilename(String) - -Method in interface org.owasp.esapi.Randomizer -
- Returns an unguessable random filename with the specified extension. -
- getRandomFilename(String) - -Method in class org.owasp.esapi.reference.DefaultRandomizer -
- Returns an unguessable random filename with the specified extension. -
- getRandomGUID() - -Method in interface org.owasp.esapi.Randomizer -
- Generates a random GUID. -
- getRandomGUID() - -Method in class org.owasp.esapi.reference.DefaultRandomizer -
- -
- getRandomInteger(int, int) - -Method in interface org.owasp.esapi.Randomizer -
- Gets the random integer. -
- getRandomInteger(int, int) - -Method in class org.owasp.esapi.reference.DefaultRandomizer -
- (non-Javadoc) -
- getRandomLong() - -Method in interface org.owasp.esapi.Randomizer -
- Gets the random long. -
- getRandomLong() - -Method in class org.owasp.esapi.reference.DefaultRandomizer -
- (non-Javadoc) -
- getRandomReal(float, float) - -Method in interface org.owasp.esapi.Randomizer -
- Gets the random real. -
- getRandomReal(float, float) - -Method in class org.owasp.esapi.reference.DefaultRandomizer -
- -
- getRandomString(int, char[]) - -Method in interface org.owasp.esapi.Randomizer -
- Gets a random string. -
- getRandomString(int, char[]) - -Method in class org.owasp.esapi.reference.DefaultRandomizer -
- -
- getReader() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getReader() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getRealPath(String) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getRealPath(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getRelativeTimeStamp(long) - -Method in interface org.owasp.esapi.Encryptor -
- Gets an absolute timestamp representing an offset from the current time to be used by - other functions in the library. -
- getRelativeTimeStamp(long) - -Method in class org.owasp.esapi.reference.JavaEncryptor -
- -
- getRememberTokenDuration() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the time window allowed for the remember token in milliseconds. -
- getRememberTokenDuration() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- -
- getRemoteAddr() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getRemoteAddr() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getRemoteHost() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getRemoteHost() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getRemotePort() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- getRemotePort() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getRemoteUser() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the name of the ESAPI user associated with this request. -
- getRemoteUser() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getRequestDispatcher(String) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Checks to make sure the path to forward to is within the WEB-INF directory - and then returns the dispatcher. -
- getRequestDispatcher(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getRequestURI() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the URI from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getRequestURI() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getRequestURL() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the URL from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getRequestURL() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getRequestedSessionId() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the URI from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getRequestedSessionId() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getResourceDirectory() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the ESAPI resource directory as a String. -
- getResourceDirectory() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the resource directory. -
- getResponseContentType() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the content-type set for responses. -
- getResponseContentType() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- -
- getRoles() - -Method in interface org.owasp.esapi.User -
- Gets the roles assigned to a particular account. -
- getRoles() - -Method in class org.owasp.esapi.reference.DefaultUser -
- Gets the roles. -
- getSafeFileUploads(HttpServletRequest, File, File) - -Method in interface org.owasp.esapi.HTTPUtilities -
- Extract uploaded files from a multipart HTTP requests. -
- getSafeFileUploads(HttpServletRequest, File, File) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- Uses the Apache Commons FileUploader to parse the multipart HTTP request - and extract any files therein. -
- getScheme() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the scheme from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getScheme() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getScreenName() - -Method in interface org.owasp.esapi.User -
- Gets the screen name. -
- getScreenName() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- getSerialVersionUID() - -Static method in class org.owasp.esapi.errors.ValidationException -
- -
- getServerName() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the server name (host header) from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getServerName() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getServerPort() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the server port (after the : in the host header) from the HttpServletRequest after - parsing and checking the range 0-65536. -
- getServerPort() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getServletContext() - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- getServletPath() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the server path from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. -
- getServletPath() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getSession() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns a session, creating it if necessary, and sets the HttpOnly flag on the JSESSIONID cookie. -
- getSession(boolean) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns a session, creating it if necessary, and sets the HttpOnly flag on the JSESSIONID cookie. -
- getSession() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getSession(boolean) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getSessionContext() - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- getStatus() - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- Gets the status. -
- getTimeStamp() - -Method in interface org.owasp.esapi.Encryptor -
- Gets a timestamp representing the current date and time to be used by - other functions in the library. -
- getTimeStamp() - -Method in class org.owasp.esapi.reference.JavaEncryptor -
- -
- getUser(long) - -Method in interface org.owasp.esapi.Authenticator -
- Returns the User matching the provided accountId. -
- getUser(String) - -Method in interface org.owasp.esapi.Authenticator -
- Returns the User matching the provided accountName. -
- getUser(long) - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- Gets the user object with the matching account name or null if there is no match. -
- getUser(String) - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- Gets the user object with the matching account name or null if there is no match. -
- getUserMessage() - -Method in class org.owasp.esapi.errors.EnterpriseSecurityException -
- -
- getUserMessage() - -Method in class org.owasp.esapi.errors.IntrusionException -
- -
- getUserNames() - -Method in interface org.owasp.esapi.Authenticator -
- Gets a collection containing all the existing user names. -
- getUserNames() - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- Gets the user names. -
- getUserPrincipal() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns the ESAPI User associated with this request. -
- getUserPrincipal() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- getUsernameParameterName() - -Method in interface org.owasp.esapi.SecurityConfiguration -
- Gets the username parameter name. -
- getUsernameParameterName() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- Gets the username parameter name. -
- getValidCreditCard(String, String, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns a canonicalized and validated credit card number as a String. -
- getValidCreditCard(String, String, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns a canonicalized and validated credit card number as a String. -
- getValidCreditCard(String, String, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns a canonicalized and validated credit card number as a String. -
- getValidCreditCard(String, String, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- ValidationErrorList variant of getValidCreditCard -
- getValidDate(String, String, DateFormat, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns a valid date as a Date. -
- getValidDate(String, String, DateFormat, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns a valid date as a Date. -
- getValidDate(String, String, DateFormat, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- getValidDate(String, String, DateFormat, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- getValidDirectoryPath(String, String, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns a canonicalized and validated directory path as a String. -
- getValidDirectoryPath(String, String, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns a canonicalized and validated directory path as a String. -
- getValidDirectoryPath(String, String, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns a canonicalized and validated directory path as a String. -
- getValidDirectoryPath(String, String, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- ValidationErrorList variant of getValidDirectoryPath -
- getValidDouble(String, String, double, double, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns a validated real number as a double. -
- getValidDouble(String, String, double, double, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns a validated real number as a double. -
- getValidDouble(String, String, double, double, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns a validated number as a double. -
- getValidDouble(String, String, double, double, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- getValidFileContent(String, byte[], int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns validated file content as a byte array. -
- getValidFileContent(String, byte[], int, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns validated file content as a byte array. -
- getValidFileContent(String, byte[], int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns validated file content as a byte array. -
- getValidFileContent(String, byte[], int, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- getValidFileName(String, String, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns a canonicalized and validated file name as a String. -
- getValidFileName(String, String, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns a canonicalized and validated file name as a String. -
- getValidFileName(String, String, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns a canonicalized and validated file name as a String. -
- getValidFileName(String, String, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns a canonicalized and validated file name as a String. -
- getValidInput(String, String, String, int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns canonicalized and validated input as a String. -
- getValidInput(String, String, String, int, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns canonicalized and validated input as a String. -
- getValidInput(String, String, String, int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Validates data received from the browser and returns a safe version. -
- getValidInput(String, String, String, int, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Validates data received from the browser and returns a safe version. -
- getValidInteger(String, String, int, int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns a validated integer. -
- getValidInteger(String, String, int, int, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns a validated integer. -
- getValidInteger(String, String, int, int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns a validated number as a double. -
- getValidInteger(String, String, int, int, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- getValidListItem(String, String, List) - -Method in interface org.owasp.esapi.Validator -
- Returns the list item that exactly matches the canonicalized input. -
- getValidListItem(String, String, List, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns the list item that exactly matches the canonicalized input. -
- getValidListItem(String, String, List) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns the list item that exactly matches the canonicalized input. -
- getValidListItem(String, String, List, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- ValidationErrorList variant of getValidListItem -
- getValidNumber(String, String, long, long, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns a validated number as a double within the range of minValue to maxValue. -
- getValidNumber(String, String, long, long, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns a validated number as a double within the range of minValue to maxValue. -
- getValidNumber(String, String, long, long, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns a validated number as a double. -
- getValidNumber(String, String, long, long, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- getValidPrintable(String, byte[], int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns canonicalized and validated printable characters as a byte array. -
- getValidPrintable(String, byte[], int, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns canonicalized and validated printable characters as a byte array. -
- getValidPrintable(String, String, int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns canonicalized and validated printable characters as a String. -
- getValidPrintable(String, String, int, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns canonicalized and validated printable characters as a String. -
- getValidPrintable(String, byte[], int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns canonicalized and validated printable characters as a byte array. -
- getValidPrintable(String, byte[], int, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- ValidationErrorList variant of getValidPrintable -
- getValidPrintable(String, String, int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns canonicalized and validated printable characters as a String. -
- getValidPrintable(String, String, int, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- ValidationErrorList variant of getValidPrintable -
- getValidRedirectLocation(String, String, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns a canonicalized and validated redirect location as a String. -
- getValidRedirectLocation(String, String, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns a canonicalized and validated redirect location as a String. -
- getValidRedirectLocation(String, String, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns a canonicalized and validated redirect location as a String. -
- getValidRedirectLocation(String, String, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- ValidationErrorList variant of getValidRedirectLocation -
- getValidSafeHTML(String, String, int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns canonicalized and validated "safe" HTML. -
- getValidSafeHTML(String, String, int, boolean, ValidationErrorList) - -Method in interface org.owasp.esapi.Validator -
- Returns canonicalized and validated "safe" HTML. -
- getValidSafeHTML(String, String, int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- getValidSafeHTML(String, String, int, boolean, ValidationErrorList) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- ValidationErrorList variant of getValidSafeHTML -
- getValidationPattern(String) - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- -
- getValidationPatternNames() - -Method in class org.owasp.esapi.reference.DefaultSecurityConfiguration -
- -
- getValue(String) - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- getValueNames() - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- getWriter() - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- getWriter() - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-8.html b/javadoc/index-files/index-8.html deleted file mode 100644 index 43b74cf27..000000000 --- a/javadoc/index-files/index-8.html +++ /dev/null @@ -1,161 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-H
--
-
- HTMLEntityCodec - class org.owasp.esapi.codecs.HTMLEntityCodec.
- Implementation of the Codec interface for HTML entity encoding.
- HTMLEntityCodec() - -Constructor for class org.owasp.esapi.codecs.HTMLEntityCodec -
- -
- HTTPUtilities - interface org.owasp.esapi.HTTPUtilities.
- The HTTPUtilities interface is a collection of methods that provide additional security related to HTTP requests, - responses, sessions, cookies, headers, and logging.
- HTTPUtilitiesTest - class org.owasp.esapi.reference.HTTPUtilitiesTest.
- The Class HTTPUtilitiesTest.
- HTTPUtilitiesTest(String) - -Constructor for class org.owasp.esapi.reference.HTTPUtilitiesTest -
- Instantiates a new HTTP utilities test. -
- hasNext() - -Method in class org.owasp.esapi.codecs.PushbackString -
- -
- hash(String, String) - -Method in interface org.owasp.esapi.Encryptor -
- Returns a string representation of the hash of the provided plaintext and - salt. -
- hash(String, String) - -Method in class org.owasp.esapi.reference.JavaEncryptor -
- Hashes the data using the specified algorithm and the Java MessageDigest class. -
- hashPassword(String, String) - -Method in interface org.owasp.esapi.Authenticator -
- Returns a string representation of the hashed password, using the - accountName as the salt. -
- hashPassword(String, String) - -Method in class org.owasp.esapi.reference.FileBasedAuthenticator -
- -
- httpUtilities() - -Static method in class org.owasp.esapi.ESAPI -
- -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index-files/index-9.html b/javadoc/index-files/index-9.html deleted file mode 100644 index 53de06281..000000000 --- a/javadoc/index-files/index-9.html +++ /dev/null @@ -1,473 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-I
--
-
- IntegerAccessReferenceMap - class org.owasp.esapi.reference.IntegerAccessReferenceMap.
- Reference implementation of the AccessReferenceMap interface.
- IntegerAccessReferenceMap() - -Constructor for class org.owasp.esapi.reference.IntegerAccessReferenceMap -
- This AccessReferenceMap implementation uses integers to - create a layer of indirection. -
- IntegerAccessReferenceMap(Set) - -Constructor for class org.owasp.esapi.reference.IntegerAccessReferenceMap -
- Instantiates a new access reference map. -
- IntegerAccessReferenceMapTest - class org.owasp.esapi.reference.IntegerAccessReferenceMapTest.
- The Class AccessReferenceMapTest.
- IntegerAccessReferenceMapTest(String) - -Constructor for class org.owasp.esapi.reference.IntegerAccessReferenceMapTest -
- Instantiates a new access reference map test. -
- IntegrityException - exception org.owasp.esapi.errors.IntegrityException.
- An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy.
- IntegrityException(String, String) - -Constructor for class org.owasp.esapi.errors.IntegrityException -
- Creates a new instance of IntegrityException. -
- IntegrityException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.IntegrityException -
- Instantiates a new IntegrityException. -
- IntrusionDetector - interface org.owasp.esapi.IntrusionDetector.
- The IntrusionDetector interface is intended to track security relevant events and identify attack behavior.
- IntrusionDetectorTest - class org.owasp.esapi.reference.IntrusionDetectorTest.
- The Class IntrusionDetectorTest.
- IntrusionDetectorTest(String) - -Constructor for class org.owasp.esapi.reference.IntrusionDetectorTest -
- Instantiates a new intrusion detector test. -
- IntrusionException - exception org.owasp.esapi.errors.IntrusionException.
- An IntrusionException should be thrown anytime an error condition arises that is likely to be the result of an attack - in progress.
- IntrusionException(String, String) - -Constructor for class org.owasp.esapi.errors.IntrusionException -
- Creates a new instance of IntrusionException. -
- IntrusionException(String, String, Throwable) - -Constructor for class org.owasp.esapi.errors.IntrusionException -
- Instantiates a new intrusion exception. -
- include(ServletRequest, ServletResponse) - -Method in class org.owasp.esapi.http.TestRequestDispatcher -
- -
- incrementFailedLoginCount() - -Method in interface org.owasp.esapi.User -
- Increment failed login count. -
- incrementFailedLoginCount() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- index() - -Method in class org.owasp.esapi.codecs.PushbackString -
- -
- info(String, String) - -Method in interface org.owasp.esapi.Logger -
- Log success. -
- info(String, String, Throwable) - -Method in interface org.owasp.esapi.Logger -
- Log success. -
- init(FilterConfig) - -Method in class org.owasp.esapi.filters.ESAPIFilter -
- Called by the web container to indicate to a filter that it is being - placed into service. -
- init(FilterConfig) - -Method in class org.owasp.esapi.filters.SafeHTTPFilter -
- -
- interval - -Variable in class org.owasp.esapi.SecurityConfiguration.Threshold -
- -
- intrusionDetector() - -Static method in class org.owasp.esapi.ESAPI -
- -
- invalidate() - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- isAnonymous() - -Method in interface org.owasp.esapi.User -
- Checks if user is anonymous. -
- isAnonymous() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- isAuthorizedForData(String) - -Method in interface org.owasp.esapi.AccessController -
- Checks if an account is authorized to access the referenced data. -
- isAuthorizedForData(String) - -Method in class org.owasp.esapi.reference.FileBasedAccessController -
- -
- isAuthorizedForFile(String) - -Method in interface org.owasp.esapi.AccessController -
- Checks if an account is authorized to access the referenced file. -
- isAuthorizedForFile(String) - -Method in class org.owasp.esapi.reference.FileBasedAccessController -
- -
- isAuthorizedForFunction(String) - -Method in interface org.owasp.esapi.AccessController -
- Checks if an account is authorized to access the referenced function. -
- isAuthorizedForFunction(String) - -Method in class org.owasp.esapi.reference.FileBasedAccessController -
- -
- isAuthorizedForService(String) - -Method in interface org.owasp.esapi.AccessController -
- Checks if an account is authorized to access the referenced service. -
- isAuthorizedForService(String) - -Method in class org.owasp.esapi.reference.FileBasedAccessController -
- -
- isAuthorizedForURL(String) - -Method in interface org.owasp.esapi.AccessController -
- Checks if an account is authorized to access the referenced URL. -
- isAuthorizedForURL(String) - -Method in class org.owasp.esapi.reference.FileBasedAccessController -
- -
- isCommitted() - -Method in class org.owasp.esapi.filters.SafeResponse -
- Same as HttpServletResponse, no security changes required. -
- isCommitted() - -Method in class org.owasp.esapi.http.TestHttpServletResponse -
- -
- isDebugEnabled() - -Method in interface org.owasp.esapi.Logger -
- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing -
- isEmpty() - -Method in class org.owasp.esapi.ValidationErrorList -
- Returns true if no error are present. -
- isEnabled() - -Method in interface org.owasp.esapi.User -
- Checks if an account is currently enabled. -
- isEnabled() - -Method in class org.owasp.esapi.reference.DefaultUser -
- Checks if is enabled. -
- isErrorEnabled() - -Method in interface org.owasp.esapi.Logger -
- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing -
- isExpired() - -Method in interface org.owasp.esapi.User -
- Checks if an account is expired. -
- isExpired() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- isFatalEnabled() - -Method in interface org.owasp.esapi.Logger -
- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing -
- isHexDigit(Character) - -Method in class org.owasp.esapi.codecs.PushbackString -
- -
- isInRole(String) - -Method in interface org.owasp.esapi.User -
- Checks if an account has been assigned a particular role. -
- isInRole(String) - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- isInfoEnabled() - -Method in interface org.owasp.esapi.Logger -
- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing -
- isLocked() - -Method in interface org.owasp.esapi.User -
- Checks if an account is locked. -
- isLocked() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- isLoggedIn() - -Method in interface org.owasp.esapi.User -
- Tests to see if the user is currently logged in. -
- isLoggedIn() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- isNew() - -Method in class org.owasp.esapi.http.TestHttpSession -
- -
- isPushback() - -Method in class org.owasp.esapi.codecs.PushbackString -
- -
- isRequestedSessionIdFromCookie() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- isRequestedSessionIdFromCookie() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- isRequestedSessionIdFromURL() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- isRequestedSessionIdFromURL() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- isRequestedSessionIdFromUrl() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- isRequestedSessionIdFromUrl() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- isRequestedSessionIdValid() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- isRequestedSessionIdValid() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- isSecure() - -Method in class org.owasp.esapi.filters.SafeRequest -
- Same as HttpServletRequest, no security changes required. -
- isSecure() - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- isSecureChannel(HttpServletRequest) - -Method in class org.owasp.esapi.reference.DefaultHTTPUtilities -
- Returns true if the request was transmitted over an SSL enabled - connection. -
- isSessionAbsoluteTimeout() - -Method in interface org.owasp.esapi.User -
- Tests to see if the user's session has exceeded the absolute time out. -
- isSessionAbsoluteTimeout() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- isSessionTimeout() - -Method in interface org.owasp.esapi.User -
- Tests to see if the user's session has timed out from inactivity. -
- isSessionTimeout() - -Method in class org.owasp.esapi.reference.DefaultUser -
- -
- isTraceEnabled() - -Method in interface org.owasp.esapi.Logger -
- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing -
- isUserInRole(String) - -Method in class org.owasp.esapi.filters.SafeRequest -
- Returns true if the ESAPI User associated with this request has the specified role. -
- isUserInRole(String) - -Method in class org.owasp.esapi.http.TestHttpServletRequest -
- -
- isValidCreditCard(String, String, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input is a valid credit card. -
- isValidCreditCard(String, String, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- isValidDate(String, String, DateFormat, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input is a valid date according to the specified date format. -
- isValidDate(String, String, DateFormat, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns true if input is a valid date according to the specified date format. -
- isValidDirectoryPath(String, String, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input is a valid directory path. -
- isValidDirectoryPath(String, String, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns true if the directory path (not including a filename) is valid. -
- isValidDouble(String, String, double, double, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input is a valid double within the range of minValue to maxValue. -
- isValidDouble(String, String, double, double, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- isValidFileContent(String, byte[], int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input is valid file content. -
- isValidFileContent(String, byte[], int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns true if input is valid file content. -
- isValidFileName(String, String, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input is a valid file name. -
- isValidFileName(String, String, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns true if input is a valid file name. -
- isValidFileUpload(String, String, String, byte[], int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if a file upload has a valid name, path, and content. -
- isValidFileUpload(String, String, String, byte[], int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns true if a file upload has a valid name, path, and content. -
- isValidHTTPRequest() - -Method in interface org.owasp.esapi.Validator -
- Validate the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. -
- isValidHTTPRequest() - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. -
- isValidHTTPRequest(HttpServletRequest) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. -
- isValidHTTPRequestParameterSet(String, Set, Set) - -Method in interface org.owasp.esapi.Validator -
- Returns true if the parameters in the current request contain all required parameters and only optional ones in addition. -
- isValidHTTPRequestParameterSet(String, Set, Set) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- isValidInput(String, String, String, int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input is valid according to the specified type. -
- isValidInput(String, String, String, int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns true if data received from browser is valid. -
- isValidInteger(String, String, int, int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input is a valid integer within the range of minValue to maxValue. -
- isValidInteger(String, String, int, int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- isValidListItem(String, String, List) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input is a valid list item. -
- isValidListItem(String, String, List) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- isValidNumber(String, String, long, long, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input is a valid number within the range of minValue to maxValue. -
- isValidNumber(String, String, long, long, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- isValidPrintable(String, byte[], int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input contains only valid printable ASCII characters. -
- isValidPrintable(String, String, int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input contains only valid printable ASCII characters (32-126). -
- isValidPrintable(String, byte[], int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Checks that all bytes are valid ASCII characters (between 33 and 126 - inclusive). -
- isValidPrintable(String, String, int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- isValidRedirectLocation(String, String, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input is a valid redirect location, as defined by "ESAPI.properties". -
- isValidRedirectLocation(String, String, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- Returns true if input is a valid redirect location. -
- isValidSafeHTML(String, String, int, boolean) - -Method in interface org.owasp.esapi.Validator -
- Returns true if input is "safe" HTML. -
- isValidSafeHTML(String, String, int, boolean) - -Method in class org.owasp.esapi.reference.DefaultValidator -
- -
- isWarningEnabled() - -Method in interface org.owasp.esapi.Logger -
- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing -
- iterator() - -Method in interface org.owasp.esapi.AccessReferenceMap -
- Get an iterator through the direct object references. -
- iterator() - -Method in class org.owasp.esapi.reference.IntegerAccessReferenceMap -
- -
- iterator() - -Method in class org.owasp.esapi.reference.RandomAccessReferenceMap -
- -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV LETTER - NEXT LETTER | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/index.html b/javadoc/index.html deleted file mode 100644 index 7d2085a92..000000000 --- a/javadoc/index.html +++ /dev/null @@ -1,26 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class AccessControlException
--java.lang.Object --java.lang.Throwable -
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class AccessControlException
- extends EnterpriseSecurityException
-An AccessControlException should be thrown when a user attempts to access a - resource that they are not authorized for. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AccessControlException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EnterpriseSecurityException. |
-|
AccessControlException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new access control exception. |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AccessControlException
--public AccessControlException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EnterpriseSecurityException.
-
-
- -
-AccessControlException
--public AccessControlException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new access control exception.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/AccessController.html b/javadoc/org/owasp/esapi/AccessController.html deleted file mode 100644 index 66efe3b83..000000000 --- a/javadoc/org/owasp/esapi/AccessController.html +++ /dev/null @@ -1,488 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface AccessController
--
-
- All Known Implementing Classes:
- FileBasedAccessController -
-
-
-
- public interface AccessController
-The IAccessController interface defines a set of methods that can be used in a wide variety of applications to - enforce access control. In most applications, access control must be performed in multiple different locations across - the various applicaton layers. This class provides access control for URLs, business functions, data, services, and - files. -
- 
-
- The implementation of this interface will need to access some sort of user information repository to determine what - roles or permissions are assigned to the accountName passed into the various methods. In addition, the implementation - will also need information about the resources that are being accessed. Using the user information and the resource - information, the implementation should return an access control decision. -
- Implementers are encouraged to build on existing access control mechanisms, such as methods like isUserInRole() or - hasPrivilege(). While powerful, these methods can be confusing, as users may be in multiple roles or possess multiple - overlapping privileges. These methods encourage the use of complex boolean tests throughout the code. The point of - this interface is to centralize access control logic so that it is easy to use and easy to verify. - -
- try {
- ESAPI.accessController().assertAuthorizedForFunction( BUSINESS_FUNCTION );
- // execute BUSINESS_FUNCTION
- } catch (AccessControlException ace) {
- ... attack in progress
- }
-
-
- Note that in the user interface layer, access control checks can be used to control whether particular controls are
- rendered or not. These checks are supposed to fail when an unauthorized user is logged in, and do not represent
- attacks. Remember that regardless of how the user interface appears, an attacker can attempt to invoke any business
- function or access any data in your application. Therefore, access control checks in the user interface should be
- repeated in both the business logic and data layers.
-
-
- <% if ( ESAPI.accessController().isAuthorizedForFunction( ADMIN_FUNCTION ) ) { %>
- <a href="/doAdminFunction">ADMIN</a>
- <% } else { %>
- <a href="/doNormalFunction">NORMAL</a>
- <% } %>
-
-- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Method Summary | -|
- void |
-assertAuthorizedForData(java.lang.String key)
-
-- Checks if an account is authorized to access the referenced data. |
-
- void |
-assertAuthorizedForFile(java.lang.String filepath)
-
-- Checks if an account is authorized to access the referenced file. |
-
- void |
-assertAuthorizedForFunction(java.lang.String functionName)
-
-- Checks if an account is authorized to access the referenced function. |
-
- void |
-assertAuthorizedForService(java.lang.String serviceName)
-
-- Checks if an account is authorized to access the referenced service. |
-
- void |
-assertAuthorizedForURL(java.lang.String url)
-
-- Checks if an account is authorized to access the referenced URL. |
-
- boolean |
-isAuthorizedForData(java.lang.String key)
-
-- Checks if an account is authorized to access the referenced data. |
-
- boolean |
-isAuthorizedForFile(java.lang.String filepath)
-
-- Checks if an account is authorized to access the referenced file. |
-
- boolean |
-isAuthorizedForFunction(java.lang.String functionName)
-
-- Checks if an account is authorized to access the referenced function. |
-
- boolean |
-isAuthorizedForService(java.lang.String serviceName)
-
-- Checks if an account is authorized to access the referenced service. |
-
- boolean |
-isAuthorizedForURL(java.lang.String url)
-
-- Checks if an account is authorized to access the referenced URL. |
-
| -Method Detail | -
-isAuthorizedForURL
--public boolean isAuthorizedForURL(java.lang.String url)-
-
-
- Checks if an account is authorized to access the referenced URL. The implementation should allow
- access to be granted to any part of the URL. Generally, this method should be invoked in the
- application's controller or a filter as follows:
-
ESAPI.accessController().isAuthorizedForURL(request.getRequestURI().toString());
--
-
-
-
- Returns:
- true, if is authorized for URL
- -
-isAuthorizedForFunction
--public boolean isAuthorizedForFunction(java.lang.String functionName)-
-
-
- Checks if an account is authorized to access the referenced function. The implementation should define the
- function "namespace" to be enforced. Choosing something simple like the classname of action classes or menu item
- names will make this implementation easier to use.
-
-
-
-
- Parameters:
functionName- the function name -- Returns:
- true, if is authorized for function
- -
-isAuthorizedForData
--public boolean isAuthorizedForData(java.lang.String key)-
-
-
- Checks if an account is authorized to access the referenced data. The implementation should define the data
- "namespace" to be enforced.
-
-
-
-
- Parameters:
key- the key -- Returns:
- true, if is authorized for data
- -
-isAuthorizedForFile
--public boolean isAuthorizedForFile(java.lang.String filepath)-
-
-
- Checks if an account is authorized to access the referenced file. The implementation should be extremely careful
- about canonicalization.
-
-
-
-
- Parameters:
filepath- the path of the file to be checked, including filename -- Returns:
- true, if is authorized for file
- See Also:
Encoder.canonicalize(String)
- -
-isAuthorizedForService
--public boolean isAuthorizedForService(java.lang.String serviceName)-
-
-
- Checks if an account is authorized to access the referenced service. This can be used in applications that
- provide access to a variety of backend services.
-
-
-
-
- Parameters:
serviceName- the service name -- Returns:
- true, if is authorized for service
- -
-assertAuthorizedForURL
--public void assertAuthorizedForURL(java.lang.String url) - throws AccessControlException-
-
-
- Checks if an account is authorized to access the referenced URL. The implementation should allow
- access to be granted to any part of the URL. Generally, this method should be invoked in the
- application's controller or a filter as follows:
-
ESAPI.accessController().assertAuthorizedForURL(request.getRequestURI().toString());
--
-
-
- Parameters:
url- the url as returned by request.getRequestURI().toString() -- Throws: -
AccessControlException- if access is not permitted
- -
-assertAuthorizedForFunction
--public void assertAuthorizedForFunction(java.lang.String functionName) - throws AccessControlException-
-
-
- Checks if an account is authorized to access the referenced function. The implementation should define the
- function "namespace" to be enforced. Choosing something simple like the classname of action classes or menu item
- names will make this implementation easier to use.
-
-
-
-
- Parameters:
functionName- the function name -- Throws: -
AccessControlException- if access is not permitted
- -
-assertAuthorizedForData
--public void assertAuthorizedForData(java.lang.String key) - throws AccessControlException-
-
-
- Checks if an account is authorized to access the referenced data. The implementation should define the data
- "namespace" to be enforced.
-
-
-
-
- Parameters:
key- the key -- Throws: -
AccessControlException- is access is not permitted
- -
-assertAuthorizedForFile
--public void assertAuthorizedForFile(java.lang.String filepath) - throws AccessControlException-
-
-
- Checks if an account is authorized to access the referenced file. The implementation should be extremely careful
- about canonicalization.
-
-
-
-
- Parameters:
filepath- the path of the file to be checked, including filename -- Throws: -
AccessControlException- is access is not permitted- See Also:
Encoder.canonicalize(String)
- -
-assertAuthorizedForService
--public void assertAuthorizedForService(java.lang.String serviceName) - throws AccessControlException-
-
-
- Checks if an account is authorized to access the referenced service. This can be used in applications that
- provide access to a variety of backend services.
-
-
-
-
- Parameters:
serviceName- the service name -- Throws: -
AccessControlException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/AccessControllerTest.html b/javadoc/org/owasp/esapi/AccessControllerTest.html deleted file mode 100644 index ffa35d691..000000000 --- a/javadoc/org/owasp/esapi/AccessControllerTest.html +++ /dev/null @@ -1,426 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class AccessControllerTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class AccessControllerTest
- extends junit.framework.TestCase
-The Class AccessControllerTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
AccessControllerTest(java.lang.String testName)
-
-- Instantiates a new access controller test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testIsAuthorizedForBackendService()
-
-- Test of isAuthorizedForBackendService method, of class - org.owasp.esapi.AccessController. |
-
- void |
-testIsAuthorizedForData()
-
-- Test of isAuthorizedForData method, of class - org.owasp.esapi.AccessController. |
-
- void |
-testIsAuthorizedForFile()
-
-- Test of isAuthorizedForFile method, of class - org.owasp.esapi.AccessController. |
-
- void |
-testIsAuthorizedForFunction()
-
-- Test of isAuthorizedForFunction method, of class - org.owasp.esapi.AccessController. |
-
- void |
-testIsAuthorizedForURL()
-
-- Test of isAuthorizedForURL method, of class - org.owasp.esapi.AccessController. |
-
- void |
-testMatchRule()
-
-- |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AccessControllerTest
--public AccessControllerTest(java.lang.String testName) - throws java.lang.Exception-
-
-
- Instantiates a new access controller test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testMatchRule
--public void testMatchRule()-
-
-
-
-
-
- -
-testIsAuthorizedForURL
--public void testIsAuthorizedForURL() - throws java.lang.Exception-
-
-
- Test of isAuthorizedForURL method, of class
- org.owasp.esapi.AccessController.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testIsAuthorizedForFunction
--public void testIsAuthorizedForFunction()-
-
-
- Test of isAuthorizedForFunction method, of class
- org.owasp.esapi.AccessController.
-
-
-
-
- -
-testIsAuthorizedForData
--public void testIsAuthorizedForData()-
-
-
- Test of isAuthorizedForData method, of class
- org.owasp.esapi.AccessController.
-
-
-
-
- -
-testIsAuthorizedForFile
--public void testIsAuthorizedForFile()-
-
-
- Test of isAuthorizedForFile method, of class
- org.owasp.esapi.AccessController.
-
-
-
-
- -
-testIsAuthorizedForBackendService
--public void testIsAuthorizedForBackendService()-
-
-
- Test of isAuthorizedForBackendService method, of class
- org.owasp.esapi.AccessController.
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/AccessReferenceMap.html b/javadoc/org/owasp/esapi/AccessReferenceMap.html deleted file mode 100644 index 72acc2120..000000000 --- a/javadoc/org/owasp/esapi/AccessReferenceMap.html +++ /dev/null @@ -1,389 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface AccessReferenceMap
--
-
- All Known Implementing Classes:
- IntegerAccessReferenceMap, RandomAccessReferenceMap -
-
-
-
- public interface AccessReferenceMap
-The AccessReferenceMap interface is used to map from a set of internal - direct object references to a set of indirect references that are safe to - disclose publicly. This can be used to help protect database keys, - filenames, and other types of direct object references. As a rule, developers - should not expose their direct object references as it enables attackers to - attempt to manipulate them. -
- 
-
-
- Indirect references are handled as strings, to facilitate their use in HTML. - Implementations can generate simple integers or more complicated random - character strings as indirect references. Implementations should probably add - a constructor that takes a list of direct references. -
- Note that in addition to defeating all forms of parameter tampering attacks, - there is a side benefit of the AccessReferenceMap. Using random strings as indirect object - references, as opposed to simple integers makes it impossible for an attacker to - guess valid identifiers. So if per-user AccessReferenceMaps are used, then request - forgery (CSRF) attacks will also be prevented. - -
- Set fileSet = new HashSet(); - fileSet.addAll(...); // add direct references (e.g. File objects) - AccessReferenceMap map = new AccessReferenceMap( fileSet ); - // store the map somewhere safe - like the session! - String indRef = map.getIndirectReference( file1 ); - String href = "http://www.aspectsecurity.com/esapi?file=" + indRef ); - ... - // if the indirect reference doesn't exist, it's likely an attack - // getDirectReference throws an AccessControlException - // you should handle as appropriate - String indref = request.getParameter( "file" ); - File file = (File)map.getDirectReference( indref ); -- -
-
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Method Summary | -|
- java.lang.String |
-addDirectReference(java.lang.Object direct)
-
-- Adds a direct reference to the AccessReferenceMap and generates an associated indirect reference. |
-
- java.lang.Object |
-getDirectReference(java.lang.String indirectReference)
-
-- Get the original direct object reference from an indirect reference. |
-
- java.lang.String |
-getIndirectReference(java.lang.Object directReference)
-
-- Get a safe indirect reference to use in place of a potentially sensitive - direct object reference. |
-
- java.util.Iterator |
-iterator()
-
-- Get an iterator through the direct object references. |
-
- java.lang.String |
-removeDirectReference(java.lang.Object direct)
-
-- Removes a direct reference and its associated indirect reference from the AccessReferenceMap. |
-
- void |
-update(java.util.Set directReferences)
-
-- Updates the access reference map with a new set of directReferences, maintaining - any existing indirectReferences associated with items that are in the new list. |
-
| -Method Detail | -
-iterator
--public java.util.Iterator iterator()-
-
-
- Get an iterator through the direct object references. No guarantee is made as
- to the order of items returned.
-
-
-
-
-
- Returns:
- the iterator
- -
-getIndirectReference
--public java.lang.String getIndirectReference(java.lang.Object directReference)-
-
-
- Get a safe indirect reference to use in place of a potentially sensitive
- direct object reference. Developers should use this call when building
- URL's, form fields, hidden fields, etc... to help protect their private
- implementation information.
-
-
-
-
- Parameters:
directReference- the direct reference -- Returns:
- the indirect reference
- -
-getDirectReference
--public java.lang.Object getDirectReference(java.lang.String indirectReference) - throws AccessControlException-
-
-
- Get the original direct object reference from an indirect reference.
- Developers should use this when they get an indirect reference from a
- request to translate it back into the real direct reference. If an
- invalid indirectReference is requested, then an AccessControlException is
- thrown.
-
-
-
-
- Parameters:
indirectReference- the indirect reference -- Returns:
- the direct reference -
- Throws: -
AccessControlException- if no direct reference exists for the - specified indirect reference
- -
-addDirectReference
--public java.lang.String addDirectReference(java.lang.Object direct)-
-
-
- Adds a direct reference to the AccessReferenceMap and generates an associated indirect reference.
-
-
-
-
- Parameters:
direct- the direct reference -- Returns:
- the corresponding indirect reference
- -
-removeDirectReference
--public java.lang.String removeDirectReference(java.lang.Object direct) - throws AccessControlException-
-
-
- Removes a direct reference and its associated indirect reference from the AccessReferenceMap.
-
-
-
-
- Parameters:
direct- the direct reference to remove -- Returns:
- the corresponding indirect reference -
- Throws: -
AccessControlException
- -
-update
--public void update(java.util.Set directReferences)-
-
-
- Updates the access reference map with a new set of directReferences, maintaining
- any existing indirectReferences associated with items that are in the new list.
-
-
-
-
- Parameters:
directReferences-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/AccessReferenceMapTest.html b/javadoc/org/owasp/esapi/AccessReferenceMapTest.html deleted file mode 100644 index 721b414e5..000000000 --- a/javadoc/org/owasp/esapi/AccessReferenceMapTest.html +++ /dev/null @@ -1,428 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class AccessReferenceMapTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class AccessReferenceMapTest
- extends junit.framework.TestCase
-The Class AccessReferenceMapTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
AccessReferenceMapTest(java.lang.String testName)
-
-- Instantiates a new access reference map test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testAddDirectReference()
-
-- |
-
- void |
-testGetDirectReference()
-
-- Test of getDirectReference method, of class - org.owasp.esapi.AccessReferenceMap. |
-
- void |
-testGetIndirectReference()
-
-- Test of getIndirectReference method, of class - org.owasp.esapi.AccessReferenceMap. |
-
- void |
-testIterator()
-
-- Test of iterator method, of class org.owasp.esapi.AccessReferenceMap. |
-
- void |
-testRemoveDirectReference()
-
-- |
-
- void |
-testUpdate()
-
-- Test of update method, of class org.owasp.esapi.AccessReferenceMap. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AccessReferenceMapTest
--public AccessReferenceMapTest(java.lang.String testName)-
-
-
- Instantiates a new access reference map test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testUpdate
--public void testUpdate() - throws AuthenticationException, - EncryptionException-
-
-
- Test of update method, of class org.owasp.esapi.AccessReferenceMap.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception -EncryptionException
- -
-testIterator
--public void testIterator()-
-
-
- Test of iterator method, of class org.owasp.esapi.AccessReferenceMap.
-
-
-
-
- -
-testGetIndirectReference
--public void testGetIndirectReference()-
-
-
- Test of getIndirectReference method, of class
- org.owasp.esapi.AccessReferenceMap.
-
-
-
-
- -
-testGetDirectReference
--public void testGetDirectReference() - throws AccessControlException-
-
-
- Test of getDirectReference method, of class
- org.owasp.esapi.AccessReferenceMap.
-
-
-
-
-
- Throws: -
AccessControlException- the access control exception
- -
-testAddDirectReference
--public void testAddDirectReference() - throws AccessControlException-
-
-
-
-
-
- Throws: -
AccessControlException
-
- -
-testRemoveDirectReference
--public void testRemoveDirectReference() - throws AccessControlException-
-
-
-
-
-
- Throws: -
AccessControlException
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/AllTests.html b/javadoc/org/owasp/esapi/AllTests.html deleted file mode 100644 index bc761c0b0..000000000 --- a/javadoc/org/owasp/esapi/AllTests.html +++ /dev/null @@ -1,288 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class AllTests
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class AllTests
- extends junit.framework.TestCase
-The Class AllTests. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
AllTests(java.lang.String testName)
-
-- Instantiates a new all tests. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- suite method automatically generated by JUnit module. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AllTests
--public AllTests(java.lang.String testName)-
-
-
- Instantiates a new all tests.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- suite method automatically generated by JUnit module.
-
-
-
-
-
- Returns:
- the test
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/AuthenticationAccountsException.html b/javadoc/org/owasp/esapi/AuthenticationAccountsException.html deleted file mode 100644 index ffd28a786..000000000 --- a/javadoc/org/owasp/esapi/AuthenticationAccountsException.html +++ /dev/null @@ -1,279 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class AuthenticationAccountsException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class AuthenticationAccountsException
- extends AuthenticationException
-An AuthenticationException should be thrown when anything goes wrong during - login or logout. They are also appropriate for any problems related to - identity management. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AuthenticationAccountsException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EnterpriseSecurityException. |
-|
AuthenticationAccountsException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new authentication exception. |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AuthenticationAccountsException
--public AuthenticationAccountsException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EnterpriseSecurityException.
-
-
- -
-AuthenticationAccountsException
--public AuthenticationAccountsException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new authentication exception.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/AuthenticationCredentialsException.html b/javadoc/org/owasp/esapi/AuthenticationCredentialsException.html deleted file mode 100644 index f0cef0d15..000000000 --- a/javadoc/org/owasp/esapi/AuthenticationCredentialsException.html +++ /dev/null @@ -1,279 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class AuthenticationCredentialsException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class AuthenticationCredentialsException
- extends AuthenticationException
-An AuthenticationException should be thrown when anything goes wrong during - login or logout. They are also appropriate for any problems related to - identity management. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AuthenticationCredentialsException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EnterpriseSecurityException. |
-|
AuthenticationCredentialsException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new authentication exception. |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AuthenticationCredentialsException
--public AuthenticationCredentialsException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EnterpriseSecurityException.
-
-
- -
-AuthenticationCredentialsException
--public AuthenticationCredentialsException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new authentication exception.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/AuthenticationException.html b/javadoc/org/owasp/esapi/AuthenticationException.html deleted file mode 100644 index 0cd9eea09..000000000 --- a/javadoc/org/owasp/esapi/AuthenticationException.html +++ /dev/null @@ -1,281 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class AuthenticationException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
- Direct Known Subclasses:
- AuthenticationAccountsException, AuthenticationCredentialsException, AuthenticationHostException, AuthenticationLoginException -
-
-
-
- public class AuthenticationException
- extends EnterpriseSecurityException
-An AuthenticationException should be thrown when anything goes wrong during - login or logout. They are also appropriate for any problems related to - identity management. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AuthenticationException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EnterpriseSecurityException. |
-|
AuthenticationException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new authentication exception. |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AuthenticationException
--public AuthenticationException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EnterpriseSecurityException.
-
-
- -
-AuthenticationException
--public AuthenticationException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new authentication exception.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/AuthenticationHostException.html b/javadoc/org/owasp/esapi/AuthenticationHostException.html deleted file mode 100644 index 4526e02f6..000000000 --- a/javadoc/org/owasp/esapi/AuthenticationHostException.html +++ /dev/null @@ -1,278 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class AuthenticationHostException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class AuthenticationHostException
- extends AuthenticationException
-An AuthenticationHostException should be thrown when there is a problem with - the host involved with authentication, particularly if the host changes unexpectedly. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AuthenticationHostException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of AuthenticationHostException. |
-|
AuthenticationHostException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new authentication exception. |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AuthenticationHostException
--public AuthenticationHostException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of AuthenticationHostException.
-
-
- -
-AuthenticationHostException
--public AuthenticationHostException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new authentication exception.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/AuthenticationLoginException.html b/javadoc/org/owasp/esapi/AuthenticationLoginException.html deleted file mode 100644 index 981e58a1b..000000000 --- a/javadoc/org/owasp/esapi/AuthenticationLoginException.html +++ /dev/null @@ -1,279 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class AuthenticationLoginException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class AuthenticationLoginException
- extends AuthenticationException
-An AuthenticationException should be thrown when anything goes wrong during - login or logout. They are also appropriate for any problems related to - identity management. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AuthenticationLoginException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EnterpriseSecurityException. |
-|
AuthenticationLoginException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new authentication exception. |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AuthenticationLoginException
--public AuthenticationLoginException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EnterpriseSecurityException.
-
-
- -
-AuthenticationLoginException
--public AuthenticationLoginException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new authentication exception.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/Authenticator.html b/javadoc/org/owasp/esapi/Authenticator.html deleted file mode 100644 index 6c9b948e2..000000000 --- a/javadoc/org/owasp/esapi/Authenticator.html +++ /dev/null @@ -1,694 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface Authenticator
--
-
- All Known Implementing Classes:
- FileBasedAuthenticator -
-
-
-
- public interface Authenticator
-The Authenticator interface defines a set of methods for generating and - handling account credentials and session identifiers. The goal of this - interface is to encourage developers to protect credentials from disclosure - to the maximum extent possible. -
- 
-
- One possible implementation relies on the use of a thread local variable to - store the current user's identity. The application is responsible for calling - setCurrentUser() as soon as possible after each HTTP request is received. The - value of getCurrentUser() is used in several other places in this API. This - eliminates the need to pass a user object to methods throughout the library. - For example, all of the logging, access control, and exception calls need - access to the currently logged in user. -
- The goal is to minimize the responsibility of the developer for - authentication. In this example, the user simply calls authenticate with the - current request and the name of the parameters containing the username and - password. The implementation should verify the password if necessary, create - a session if necessary, and set the user as the current user. - -
- public void doPost(ServletRequest request, ServletResponse response) {
- try {
- User user = ESAPI.authenticator().login(request, response);
- // continue with authenticated user
- } catch (AuthenticationException e) {
- // handle failed authentication (it's already been logged)
- }
-
-- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- void |
-changePassword(User user,
- java.lang.String currentPassword,
- java.lang.String newPassword,
- java.lang.String newPassword2)
-
-- Changes the password for the specified user. |
-
- void |
-clearCurrent()
-
-- Clear the current user. |
-
- User |
-createUser(java.lang.String accountName,
- java.lang.String password1,
- java.lang.String password2)
-
-- Creates a new User with the information provided. |
-
- boolean |
-exists(java.lang.String accountName)
-
-- Determine if the account exists. |
-
- java.lang.String |
-generateStrongPassword()
-
-- Generate a strong password. |
-
- java.lang.String |
-generateStrongPassword(User user,
- java.lang.String oldPassword)
-
-- Generate strong password that takes into account the user's information and old password. |
-
- User |
-getCurrentUser()
-
-- Returns the currently logged in User. |
-
- User |
-getUser(long accountId)
-
-- Returns the User matching the provided accountId. |
-
- User |
-getUser(java.lang.String accountName)
-
-- Returns the User matching the provided accountName. |
-
- java.util.Set |
-getUserNames()
-
-- Gets a collection containing all the existing user names. |
-
- java.lang.String |
-hashPassword(java.lang.String password,
- java.lang.String accountName)
-
-- Returns a string representation of the hashed password, using the - accountName as the salt. |
-
- User |
-login(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- Authenticates the user's credentials from the HttpServletRequest if - necessary, creates a session if necessary, and sets the user as the - current user. |
-
- void |
-logout()
-
-- Logs out the current user. |
-
- void |
-removeUser(java.lang.String accountName)
-
-- Removes the account. |
-
- void |
-setCurrentUser(User user)
-
-- Sets the currently logged in User. |
-
- void |
-verifyAccountNameStrength(java.lang.String accountName)
-
-- Ensures that the account name passes site-specific complexity requirements, like minimum length. |
-
- boolean |
-verifyPassword(User user,
- java.lang.String password)
-
-- Verify that the supplied password matches the password for this user. |
-
- void |
-verifyPasswordStrength(java.lang.String oldPassword,
- java.lang.String newPassword)
-
-- Ensures that the password meets site-specific complexity requirements. |
-
| -Method Detail | -
-clearCurrent
--public void clearCurrent()-
-
-
- Clear the current user. This allows the thread to be reused safely.
-
-
-
-
- -
-login
--public User login(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response) - throws AuthenticationException-
-
-
- Authenticates the user's credentials from the HttpServletRequest if
- necessary, creates a session if necessary, and sets the user as the
- current user.
-
-
-
-
- Parameters:
request- the current HTTP requestresponse- the response -- Returns:
- the user -
- Throws: -
AuthenticationException- if the credentials are not verified, or if the account is disabled, locked, expired, or timed out
- -
-verifyPassword
--public boolean verifyPassword(User user, - java.lang.String password)-
-
-
- Verify that the supplied password matches the password for this user. This method
- is typically used for "reauthentication" for the most sensitive functions, such
- as transactions, changing email address, and changing other account information.
-
-
-
-
- Parameters:
user- the userpassword- the password -- Returns:
- true, if the password is correct for the specified user
- -
-logout
--public void logout()-
-
-
- Logs out the current user.
-
-
-
-
- -
-createUser
--public User createUser(java.lang.String accountName, - java.lang.String password1, - java.lang.String password2) - throws AuthenticationException-
-
-
- Creates a new User with the information provided. Implementations should check the
- accountName and password for proper format and strength against brute force attacks.
- Two copies of the new password are required to encourage user interface designers to
- include a "re-type password" field in their forms. Implementations should verify that both are the
- same.
-
-
-
-
- Parameters:
accountName- the account name of the new userpassword1- the password of the new userpassword2- the password of the new user. This field is to encourage user interface designers to include two password fields in their forms. -- Returns:
- the User that has been created -
- Throws: -
AuthenticationException- if user creation fails
- -
-generateStrongPassword
--public java.lang.String generateStrongPassword()-
-
-
- Generate a strong password. Implementations should use a large character set that does not
- include confusing characters, such as i I 1 l 0 o and O. There are many algorithms to
- generate strong memorable passwords that have been studied in the past.
-
-
-
-
-
- Returns:
- a password with strong password strength
- -
-generateStrongPassword
--public java.lang.String generateStrongPassword(User user, - java.lang.String oldPassword)-
-
-
- Generate strong password that takes into account the user's information and old password. Implementations
- should verify that the new password does not include information such as the username, fragments of the
- old password, and other information that could be used to weaken the strength of the password.
-
-
-
-
- Parameters:
user- the user whose information to use when generating passwordoldPassword- the old password to use when verifying strength of new password. The new password may be checked for fragments of oldPassword. -- Returns:
- a password with strong password strength
- -
-changePassword
--public void changePassword(User user, - java.lang.String currentPassword, - java.lang.String newPassword, - java.lang.String newPassword2) - throws AuthenticationException-
-
-
- Changes the password for the specified user. This requires the current password, as well as
- the password to replace it with. This new password must be repeated to ensure that the user has
- typed it in correctly.
-
-
-
-
- Parameters:
user- the user to change the password forcurrentPassword- the current password for the specified usernewPassword- the new password to usenewPassword2- a verification copy of the new password -- Throws: -
AuthenticationException- if any errors occur
- -
-getUser
--public User getUser(long accountId)-
-
-
- Returns the User matching the provided accountId.
-
-
-
-
- Parameters:
accountId- the account id -- Returns:
- the matching User object, or null if no match exists
- -
-getUser
--public User getUser(java.lang.String accountName)-
-
-
- Returns the User matching the provided accountName.
-
-
-
-
- Parameters:
accountName- the account name -- Returns:
- the matching User object, or null if no match exists
- -
-getUserNames
--public java.util.Set getUserNames()-
-
-
- Gets a collection containing all the existing user names.
-
-
-
-
-
- Returns:
- a set of all user names
- -
-getCurrentUser
--public User getCurrentUser()-
-
-
- Returns the currently logged in User.
-
-
-
-
-
- Returns:
- the matching User object, or the Anonymous user if no match - exists
- -
-setCurrentUser
--public void setCurrentUser(User user)-
-
-
- Sets the currently logged in User.
-
-
-
-
- Parameters:
user- the user to set as the current user
- -
-hashPassword
--public java.lang.String hashPassword(java.lang.String password, - java.lang.String accountName) - throws EncryptionException-
-
-
- Returns a string representation of the hashed password, using the
- accountName as the salt. The salt helps to prevent against "rainbow"
- table attacks where the attacker pre-calculates hashes for known strings.
- This method specifies the use of the user's account name as the "salt"
- value. The Encryptor.hash method can be used if a different salt is
- required.
-
-
-
-
- Parameters:
password- the password to hashaccountName- the account name to use as the salt -- Returns:
- the hashed password -
- Throws: -
EncryptionException
- -
-removeUser
--public void removeUser(java.lang.String accountName) - throws AuthenticationException-
-
-
- Removes the account.
-
-
-
-
- Parameters:
accountName- the account name to remove -- Throws: -
AuthenticationException- the authentication exception if user does not exist
- -
-verifyAccountNameStrength
--public void verifyAccountNameStrength(java.lang.String accountName) - throws AuthenticationException-
-
-
- Ensures that the account name passes site-specific complexity requirements, like minimum length.
-
-
-
-
- Parameters:
accountName- the account name -- Throws: -
AuthenticationException- if account name does not meet complexity requirements
- -
-verifyPasswordStrength
--public void verifyPasswordStrength(java.lang.String oldPassword, - java.lang.String newPassword) - throws AuthenticationException-
-
-
- Ensures that the password meets site-specific complexity requirements. This
- method takes the old password so that the algorithm can analyze the new password
- to see if it is too similar to the old password. Note that this has to be
- invoked when the user has entered the old password, as the list of old
- credentials stored by ESAPI is all hashed.
-
-
-
-
- Parameters:
oldPassword- the old passwordnewPassword- the new password -- Returns:
- true, if the new password meets complexity requirements and is not too similar to the old password -
- Throws: -
AuthenticationException- if newPassword is too similar to oldPassword or if newPassword does not meet complexity requirements
- -
-exists
--public boolean exists(java.lang.String accountName)-
-
-
- Determine if the account exists.
-
-
-
-
- Parameters:
accountName- the account name -- Returns:
- true, if the account exists
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/AuthenticatorTest.html b/javadoc/org/owasp/esapi/AuthenticatorTest.html deleted file mode 100644 index 3c4350950..000000000 --- a/javadoc/org/owasp/esapi/AuthenticatorTest.html +++ /dev/null @@ -1,656 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class AuthenticatorTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class AuthenticatorTest
- extends junit.framework.TestCase
-The Class AuthenticatorTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
AuthenticatorTest(java.lang.String testName)
-
-- Instantiates a new authenticator test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testCreateUser()
-
-- Test of createAccount method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testExists()
-
-- Test of exists method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testGenerateStrongPassword()
-
-- Test of generateStrongPassword method, of class - org.owasp.esapi.Authenticator. |
-
- void |
-testGetCurrentUser()
-
-- Test of getCurrentUser method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testGetUser()
-
-- Test of getUser method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testGetUserFromSession()
-
-- Test get user from session. |
-
- void |
-testGetUserNames()
-
-- Test get user names. |
-
- void |
-testHashPassword()
-
-- Test of hashPassword method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testLogin()
-
-- Test of login method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testMain()
-
-- Test of main method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testRemoveUser()
-
-- Test of removeAccount method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testSaveUsers()
-
-- Test of saveUsers method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testSetCurrentUser()
-
-- Test of setCurrentUser method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testSetCurrentUserWithRequest()
-
-- Test of setCurrentUser method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testValidatePasswordStrength()
-
-- Test of validatePasswordStrength method, of class - org.owasp.esapi.Authenticator. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AuthenticatorTest
--public AuthenticatorTest(java.lang.String testName)-
-
-
- Instantiates a new authenticator test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testCreateUser
--public void testCreateUser() - throws AuthenticationException, - EncryptionException-
-
-
- Test of createAccount method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception -EncryptionException
- -
-testGenerateStrongPassword
--public void testGenerateStrongPassword() - throws AuthenticationException-
-
-
- Test of generateStrongPassword method, of class
- org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testGetCurrentUser
--public void testGetCurrentUser() - throws java.lang.Exception-
-
-
- Test of getCurrentUser method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
java.lang.InterruptedException- * -AuthenticationException- the authentication exception -java.lang.Exception
- -
-testGetUser
--public void testGetUser() - throws AuthenticationException-
-
-
- Test of getUser method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testGetUserFromSession
--public void testGetUserFromSession() - throws AuthenticationException-
-
-
- Test get user from session.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testGetUserNames
--public void testGetUserNames() - throws AuthenticationException-
-
-
- Test get user names.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testHashPassword
--public void testHashPassword() - throws EncryptionException-
-
-
- Test of hashPassword method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
EncryptionException
- -
-testLogin
--public void testLogin() - throws AuthenticationException-
-
-
- Test of login method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testRemoveUser
--public void testRemoveUser() - throws java.lang.Exception-
-
-
- Test of removeAccount method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testSaveUsers
--public void testSaveUsers() - throws java.lang.Exception-
-
-
- Test of saveUsers method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testSetCurrentUser
--public void testSetCurrentUser() - throws AuthenticationException-
-
-
- Test of setCurrentUser method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testSetCurrentUserWithRequest
--public void testSetCurrentUserWithRequest() - throws AuthenticationException-
-
-
- Test of setCurrentUser method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testValidatePasswordStrength
--public void testValidatePasswordStrength() - throws AuthenticationException-
-
-
- Test of validatePasswordStrength method, of class
- org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testExists
--public void testExists() - throws java.lang.Exception-
-
-
- Test of exists method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testMain
--public void testMain() - throws java.lang.Exception-
-
-
- Test of main method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
java.lang.Exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/AvailabilityException.html b/javadoc/org/owasp/esapi/AvailabilityException.html deleted file mode 100644 index 4a50179ec..000000000 --- a/javadoc/org/owasp/esapi/AvailabilityException.html +++ /dev/null @@ -1,278 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class AvailabilityException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class AvailabilityException
- extends EnterpriseSecurityException
-An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy. For example, if a database connection pool runs out - of connections, an availability exception should be thrown. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AvailabilityException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of AvailabilityException. |
-|
AvailabilityException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new AvailabilityException. |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AvailabilityException
--public AvailabilityException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of AvailabilityException.
-
-
- -
-AvailabilityException
--public AvailabilityException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new AvailabilityException.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/CertificateException.html b/javadoc/org/owasp/esapi/CertificateException.html deleted file mode 100644 index 4aeeff768..000000000 --- a/javadoc/org/owasp/esapi/CertificateException.html +++ /dev/null @@ -1,277 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class CertificateException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class CertificateException
- extends EnterpriseSecurityException
-A CertificateException should be thrown for any problems that arise during - processing of digital certificates. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
CertificateException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of CertificateException. |
-|
CertificateException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new CertificateException. |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-CertificateException
--public CertificateException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of CertificateException.
-
-
- -
-CertificateException
--public CertificateException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new CertificateException.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/ESAPI.html b/javadoc/org/owasp/esapi/ESAPI.html deleted file mode 100644 index 285084bfa..000000000 --- a/javadoc/org/owasp/esapi/ESAPI.html +++ /dev/null @@ -1,716 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class ESAPI
--java.lang.Object --
-
-
-
- public class ESAPI
- extends java.lang.Object
-ESAPI locator class to make it easy to get a concrete implementation of the - various ESAPI classes. Use the setters to override the reference implementations - with instances of any custom ESAPI implementations. -
- -
-
- -
| -Method Summary | -|
-static AccessController |
-accessController()
-
-- |
-
-static Authenticator |
-authenticator()
-
-- |
-
-static javax.servlet.http.HttpServletRequest |
-currentRequest()
-
-- |
-
-static javax.servlet.http.HttpServletResponse |
-currentResponse()
-
-- |
-
-static Encoder |
-encoder()
-
-- |
-
-static Encryptor |
-encryptor()
-
-- |
-
-static Executor |
-executor()
-
-- |
-
-static Logger |
-getLogger(java.lang.Class clazz)
-
-- |
-
-static Logger |
-getLogger(java.lang.String name)
-
-- |
-
-static HTTPUtilities |
-httpUtilities()
-
-- |
-
-static IntrusionDetector |
-intrusionDetector()
-
-- |
-
-static Logger |
-log()
-
-- |
-
-static Randomizer |
-randomizer()
-
-- |
-
-static SecurityConfiguration |
-securityConfiguration()
-
-- |
-
-static void |
-setAccessController(AccessController accessController)
-
-- |
-
-static void |
-setAuthenticator(Authenticator authenticator)
-
-- |
-
-static void |
-setEncoder(Encoder encoder)
-
-- |
-
-static void |
-setEncryptor(Encryptor encryptor)
-
-- |
-
-static void |
-setExecutor(Executor executor)
-
-- |
-
-static void |
-setHttpUtilities(HTTPUtilities httpUtilities)
-
-- |
-
-static void |
-setIntrusionDetector(IntrusionDetector intrusionDetector)
-
-- |
-
-static void |
-setLogFactory(LogFactory factory)
-
-- |
-
-static void |
-setRandomizer(Randomizer randomizer)
-
-- |
-
-static void |
-setSecurityConfiguration(SecurityConfiguration securityConfiguration)
-
-- |
-
-static void |
-setValidator(Validator validator)
-
-- |
-
-static Validator |
-validator()
-
-- |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Method Detail | -
-currentRequest
--public static javax.servlet.http.HttpServletRequest currentRequest()-
-
-
-
-
-
- -
-currentResponse
--public static javax.servlet.http.HttpServletResponse currentResponse()-
-
-
-
-
-
- -
-accessController
--public static AccessController accessController()-
-
-
-
-
-
- Returns:
- the accessController
-
- -
-setAccessController
--public static void setAccessController(AccessController accessController)-
-
-
-
-
- Parameters:
accessController- the accessController to set
-
- -
-authenticator
--public static Authenticator authenticator()-
-
-
-
-
-
- Returns:
- the authenticator
-
- -
-setAuthenticator
--public static void setAuthenticator(Authenticator authenticator)-
-
-
-
-
- Parameters:
authenticator- the authenticator to set
-
- -
-encoder
--public static Encoder encoder()-
-
-
-
-
-
- Returns:
- the encoder
-
- -
-setEncoder
--public static void setEncoder(Encoder encoder)-
-
-
-
-
- Parameters:
encoder- the encoder to set
-
- -
-encryptor
--public static Encryptor encryptor()-
-
-
-
-
-
- Returns:
- the encryptor
-
- -
-setEncryptor
--public static void setEncryptor(Encryptor encryptor)-
-
-
-
-
- Parameters:
encryptor- the encryptor to set
-
- -
-executor
--public static Executor executor()-
-
-
-
-
-
- Returns:
- the executor
-
- -
-setExecutor
--public static void setExecutor(Executor executor)-
-
-
-
-
- Parameters:
executor- the executor to set
-
- -
-httpUtilities
--public static HTTPUtilities httpUtilities()-
-
-
-
-
-
- Returns:
- the httpUtilities
-
- -
-setHttpUtilities
--public static void setHttpUtilities(HTTPUtilities httpUtilities)-
-
-
-
-
- Parameters:
httpUtilities- the httpUtilities to set
-
- -
-intrusionDetector
--public static IntrusionDetector intrusionDetector()-
-
-
-
-
-
- Returns:
- the intrusionDetector
-
- -
-setIntrusionDetector
--public static void setIntrusionDetector(IntrusionDetector intrusionDetector)-
-
-
-
-
- Parameters:
intrusionDetector- the intrusionDetector to set
-
- -
-getLogger
--public static Logger getLogger(java.lang.Class clazz)-
-
-
-
-
-
- -
-getLogger
--public static Logger getLogger(java.lang.String name)-
-
-
-
-
-
- -
-log
--public static Logger log()-
-
-
-
-
-
- -
-setLogFactory
--public static void setLogFactory(LogFactory factory)-
-
-
-
-
- Parameters:
factory- the log factory to set
-
- -
-randomizer
--public static Randomizer randomizer()-
-
-
-
-
-
- Returns:
- the randomizer
-
- -
-setRandomizer
--public static void setRandomizer(Randomizer randomizer)-
-
-
-
-
- Parameters:
randomizer- the randomizer to set
-
- -
-securityConfiguration
--public static SecurityConfiguration securityConfiguration()-
-
-
-
-
-
- Returns:
- the securityConfiguration
-
- -
-setSecurityConfiguration
--public static void setSecurityConfiguration(SecurityConfiguration securityConfiguration)-
-
-
-
-
- Parameters:
securityConfiguration- the securityConfiguration to set
-
- -
-validator
--public static Validator validator()-
-
-
-
-
-
- Returns:
- the validator
-
- -
-setValidator
--public static void setValidator(Validator validator)-
-
-
-
-
- Parameters:
validator- the validator to set
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/ESAPITest.html b/javadoc/org/owasp/esapi/ESAPITest.html deleted file mode 100644 index 64f5cdb3c..000000000 --- a/javadoc/org/owasp/esapi/ESAPITest.html +++ /dev/null @@ -1,312 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class ESAPITest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class ESAPITest
- extends junit.framework.TestCase
-The Class ExecutorTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
ESAPITest(java.lang.String testName)
-
-- Instantiates a new executor test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testSetters()
-
-- Test of all the ESAPI setter methods |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ESAPITest
--public ESAPITest(java.lang.String testName)-
-
-
- Instantiates a new executor test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testSetters
--public void testSetters() - throws java.lang.Exception-
-
-
- Test of all the ESAPI setter methods
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/Encoder.html b/javadoc/org/owasp/esapi/Encoder.html deleted file mode 100644 index 30529aa9a..000000000 --- a/javadoc/org/owasp/esapi/Encoder.html +++ /dev/null @@ -1,917 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface Encoder
--
-
- All Known Implementing Classes:
- DefaultEncoder -
-
-
-
- public interface Encoder
-The Encoder interface contains a number of methods related to encoding input - so that it will be safe for a variety of interpreters. To prevent - double-encoding, all encoding methods should first check to see that the - input does not already contain encoded characters. There are a few methods - related to decoding that are used for canonicalization purposes. See the - Validator class for more information. -
- 
-
- All of the methods here must use a "whitelist" or "positive" security model, - meaning that all characters should be encoded, except for a specific list of - "immune" characters that are known to be safe. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Field Summary | -|
-static char[] |
-CHAR_ALPHANUMERICS
-
-- |
-
-static char[] |
-CHAR_DIGITS
-
-- |
-
-static char[] |
-CHAR_LETTERS
-
-- |
-
-static char[] |
-CHAR_LOWERS
-
-- Standard character sets |
-
-static char[] |
-CHAR_PASSWORD_DIGITS
-
-- |
-
-static char[] |
-CHAR_PASSWORD_LETTERS
-
-- |
-
-static char[] |
-CHAR_PASSWORD_LOWERS
-
-- Password character set, is alphanumerics (without l, i, I, o, O, and 0) - selected specials like + (bad for URL encoding, | is like i and 1, - etc...) |
-
-static char[] |
-CHAR_PASSWORD_SPECIALS
-
-- |
-
-static char[] |
-CHAR_PASSWORD_UPPERS
-
-- |
-
-static char[] |
-CHAR_SPECIALS
-
-- |
-
-static char[] |
-CHAR_UPPERS
-
-- |
-
| -Method Summary | -|
- java.lang.String |
-canonicalize(java.lang.String input)
-
-- This method performs canonicalization on data received to ensure that it - has been reduced to its most basic form before validation. |
-
- java.lang.String |
-canonicalize(java.lang.String input,
- boolean strict)
-
-- |
-
- byte[] |
-decodeFromBase64(java.lang.String input)
-
-- Decode data encoded with BASE-64 encoding. |
-
- java.lang.String |
-decodeFromURL(java.lang.String input)
-
-- Decode from URL. |
-
- java.lang.String |
-encodeForBase64(byte[] input,
- boolean wrap)
-
-- Encode for Base64. |
-
- java.lang.String |
-encodeForCSS(java.lang.String input)
-
-- Encode data for use in Cascading Style Sheets (CSS) content. |
-
- java.lang.String |
-encodeForDN(java.lang.String input)
-
-- Encode data for use in an LDAP distinguished name. |
-
- java.lang.String |
-encodeForHTML(java.lang.String input)
-
-- Encode data for use in HTML content. |
-
- java.lang.String |
-encodeForHTMLAttribute(java.lang.String input)
-
-- Encode data for use in HTML attributes. |
-
- java.lang.String |
-encodeForJavaScript(java.lang.String input)
-
-- Encode data for insertion inside a data value in JavaScript. |
-
- java.lang.String |
-encodeForLDAP(java.lang.String input)
-
-- Encode data for use in LDAP queries. |
-
- java.lang.String |
-encodeForSQL(Codec codec,
- java.lang.String input)
-
-- Encode for SQL according to the selected codec. |
-
- java.lang.String |
-encodeForURL(java.lang.String input)
-
-- Encode for use in a URL. |
-
- java.lang.String |
-encodeForVBScript(java.lang.String input)
-
-- Encode data for insertion inside a data value in a visual basic script. |
-
- java.lang.String |
-encodeForXML(java.lang.String input)
-
-- Encode data for use in an XML element. |
-
- java.lang.String |
-encodeForXMLAttribute(java.lang.String input)
-
-- Encode data for use in an XML attribute. |
-
- java.lang.String |
-encodeForXPath(java.lang.String input)
-
-- Encode data for use in an XPath query. |
-
- java.lang.String |
-normalize(java.lang.String input)
-
-- Reduce all non-ascii characters to their ASCII form so that simpler - validation rules can be applied. |
-
| -Field Detail | -
-CHAR_LOWERS
--public static final char[] CHAR_LOWERS-
-
-
- Standard character sets
-
-
-
-
- -
-CHAR_UPPERS
--public static final char[] CHAR_UPPERS-
-
-
-
-
- -
-CHAR_DIGITS
--public static final char[] CHAR_DIGITS-
-
-
-
-
- -
-CHAR_SPECIALS
--public static final char[] CHAR_SPECIALS-
-
-
-
-
- -
-CHAR_LETTERS
--public static final char[] CHAR_LETTERS-
-
-
-
-
- -
-CHAR_ALPHANUMERICS
--public static final char[] CHAR_ALPHANUMERICS-
-
-
-
-
- -
-CHAR_PASSWORD_LOWERS
--public static final char[] CHAR_PASSWORD_LOWERS-
-
-
- Password character set, is alphanumerics (without l, i, I, o, O, and 0)
- selected specials like + (bad for URL encoding, | is like i and 1,
- etc...)
-
-
-
-
- -
-CHAR_PASSWORD_UPPERS
--public static final char[] CHAR_PASSWORD_UPPERS-
-
-
-
-
- -
-CHAR_PASSWORD_DIGITS
--public static final char[] CHAR_PASSWORD_DIGITS-
-
-
-
-
- -
-CHAR_PASSWORD_SPECIALS
--public static final char[] CHAR_PASSWORD_SPECIALS-
-
-
-
-
- -
-CHAR_PASSWORD_LETTERS
--public static final char[] CHAR_PASSWORD_LETTERS-
-
-
-
-
| -Method Detail | -
-canonicalize
--public java.lang.String canonicalize(java.lang.String input) - throws EncodingException-
-
-
- This method performs canonicalization on data received to ensure that it
- has been reduced to its most basic form before validation. For example,
- URL-encoded data received from ordinary "application/x-www-url-encoded"
- forms so that it may be validated properly.
-
- Canonicalization is simply the operation of reducing a possibly encoded - string down to its simplest form. This is important, because attackers - frequently use encoding to change their input in a way that will bypass - validation filters, but still be interpreted properly by the target of - the attack. Note that data encoded more than once is not something that a - normal user would generate and should be regarded as an attack. -
- For input that comes from an HTTP servlet request, there are generally - two types of encoding to be concerned with. The first is - "applicaton/x-www-url-encoded" which is what is typically used in most - forms and URI's where characters are encoded in a %xy format. The other - type of common character encoding is HTML entity encoding, which uses - several formats: -
-
<
, -u
, and -:
. -- Note that all of these formats may possibly render properly in a - browser without the trailing semi-colon. -
- Double-encoding is a particularly thorny problem, as applying ordinary decoders - may introduce encoded characters, even characters encoded with a different - encoding scheme. For example %26lt; is a < character which has been entity encoded - and then the first character has been url-encoded. Implementations should - throw an IntrusionException when double-encoded characters are detected. -
- Note that there is also "multipart/form" encoding, which allows files and - other binary data to be transmitted. Each part of a multipart form can - itself be encoded according to a "Content-Transfer-Encoding" header. See - the HTTPUtilties.getSafeFileUploads() method. -
- For more information on form encoding, please refer to the W3C - specifications. -
-
-
-
- Parameters:
input- the text to canonicalize -- Returns:
- a String containing the canonicalized text -
- Throws: -
EncodingException- if canonicalization fails
- -
-canonicalize
--public java.lang.String canonicalize(java.lang.String input, - boolean strict) - throws EncodingException-
-
-
-
-
- Parameters:
input- the text to canonicalizestrict- true if checking for double encoding is desired, false otherwise -- Returns:
- a String containing the canonicalized text -
- Throws: -
EncodingException- if canonicalization fails
-
- -
-normalize
--public java.lang.String normalize(java.lang.String input)-
-
-
- Reduce all non-ascii characters to their ASCII form so that simpler
- validation rules can be applied. For example, an accented-e character
- will be changed into a regular ASCII e character.
-
-
-
-
- Parameters:
input- the text to normalize -- Returns:
- a normalized String
- -
-encodeForCSS
--public java.lang.String encodeForCSS(java.lang.String input)-
-
-
- Encode data for use in Cascading Style Sheets (CSS) content.
-
-
-
-
- Parameters:
input- the text to encode for CSS -- Returns:
- input encoded for CSS
- -
-encodeForHTML
--public java.lang.String encodeForHTML(java.lang.String input)-
-
-
- Encode data for use in HTML content.
-
-
-
-
- Parameters:
input- the text to encode for HTML -- Returns:
- input encoded for HTML
- -
-encodeForHTMLAttribute
--public java.lang.String encodeForHTMLAttribute(java.lang.String input)-
-
-
- Encode data for use in HTML attributes.
-
-
-
-
- Parameters:
input- the text to encode for an HTML attribute -- Returns:
- input encoded for use as an HTML attribute
- -
-encodeForJavaScript
--public java.lang.String encodeForJavaScript(java.lang.String input)-
-
-
- Encode data for insertion inside a data value in JavaScript. Putting user data directly
- inside a script is quite dangerous. Great care must be taken to prevent putting user data
- directly into script code itself, as no amount of encoding will prevent attacks there.
-
-
-
-
- Parameters:
input- the text to encode for JavaScript -- Returns:
- input encoded for use in JavaScript
- -
-encodeForVBScript
--public java.lang.String encodeForVBScript(java.lang.String input)-
-
-
- Encode data for insertion inside a data value in a visual basic script. Putting user data directly
- inside a script is quite dangerous. Great care must be taken to prevent putting user data
- directly into script code itself, as no amount of encoding will prevent attacks there.
-
-
-
-
- Parameters:
input- the text to encode for VBScript -- Returns:
- input encoded for use in VBScript
- -
-encodeForSQL
--public java.lang.String encodeForSQL(Codec codec, - java.lang.String input)-
-
-
- Encode for SQL according to the selected codec.
-
-
-
-
- Parameters:
codec- a Codec that declares which database 'input' is being encoded for (ie. MySQL, Oracle, etc.)input- the text to encode for SQL -- Returns:
- input encoded for use in SQL
- -
-encodeForLDAP
--public java.lang.String encodeForLDAP(java.lang.String input)-
-
-
- Encode data for use in LDAP queries.
-
-
-
-
- Parameters:
input- the text to encode for LDAP -- Returns:
- input encoded for use in LDAP
- -
-encodeForDN
--public java.lang.String encodeForDN(java.lang.String input)-
-
-
- Encode data for use in an LDAP distinguished name.
-
-
-
-
- Parameters:
input- the text to encode for an LDAP distinguished name -- Returns:
- input encoded for use in an LDAP distinguished name
- -
-encodeForXPath
--public java.lang.String encodeForXPath(java.lang.String input)-
-
-
- Encode data for use in an XPath query.
-
-
-
-
- Parameters:
input- the text to encode for XPath -- Returns:
- input encoded for use in XPath
- -
-encodeForXML
--public java.lang.String encodeForXML(java.lang.String input)-
-
-
- Encode data for use in an XML element. The implementation should follow the XML Encoding
- Standard from the W3C.
-
- The use of a real XML parser is strongly encouraged. However, in the - hopefully rare case that you need to make sure that data is safe for - inclusion in an XML document and cannot use a parse, this method provides - a safe mechanism to do so. -
-
-
-
- Parameters:
input- the text to encode for XML -- Returns:
- input encoded for use in XML
- -
-encodeForXMLAttribute
--public java.lang.String encodeForXMLAttribute(java.lang.String input)-
-
-
- Encode data for use in an XML attribute. The implementation should follow
- the XML Encoding
- Standard from the W3C.
-
- The use of a real XML parser is highly encouraged. However, in the - hopefully rare case that you need to make sure that data is safe for - inclusion in an XML document and cannot use a parse, this method provides - a safe mechanism to do so. -
-
-
-
- Parameters:
input- the text to encode for use as an XML attribute -- Returns:
- input encoded for use in an XML attribute
- -
-encodeForURL
--public java.lang.String encodeForURL(java.lang.String input) - throws EncodingException-
-
-
- Encode for use in a URL. This method performs URL encoding"
- on the entire string.
-
-
-
-
- Parameters:
input- the text to encode for use in a URL -- Returns:
- input encoded for use in a URL -
- Throws: -
EncodingException- if encoding fails
- -
-decodeFromURL
--public java.lang.String decodeFromURL(java.lang.String input) - throws EncodingException-
-
-
- Decode from URL. Implementations should first canonicalize and
- detect any double-encoding. If this check passes, then the data is decoded using URL
- decoding.
-
-
-
-
- Parameters:
input- the text to decode from an encoded URL -- Returns:
- the decoded URL value -
- Throws: -
EncodingException- if decoding fails
- -
-encodeForBase64
--public java.lang.String encodeForBase64(byte[] input, - boolean wrap)-
-
-
- Encode for Base64.
-
-
-
-
- Parameters:
input- the text to encode for Base64wrap- -- Returns:
- input encoded for Base64
- -
-decodeFromBase64
--public byte[] decodeFromBase64(java.lang.String input) - throws java.io.IOException-
-
-
- Decode data encoded with BASE-64 encoding.
-
-
-
-
- Parameters:
input- the Base64 text to decode -- Returns:
- input decoded from Base64 -
- Throws: -
java.io.IOException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/EncoderTest.html b/javadoc/org/owasp/esapi/EncoderTest.html deleted file mode 100644 index d6346393f..000000000 --- a/javadoc/org/owasp/esapi/EncoderTest.html +++ /dev/null @@ -1,658 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class EncoderTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class EncoderTest
- extends junit.framework.TestCase
-The Class EncoderTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
EncoderTest(java.lang.String testName)
-
-- Instantiates a new encoder test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testCanonicalize()
-
-- Test of canonicalize method, of class org.owasp.esapi.Validator. |
-
- void |
-testDecodeFromBase64()
-
-- Test of decodeFromBase64 method, of class org.owasp.esapi.Encoder. |
-
- void |
-testDecodeFromURL()
-
-- Test of decodeFromURL method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForBase64()
-
-- Test of encodeForBase64 method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForDN()
-
-- Test of encodeForLDAP method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForHTML()
-
-- Test of encodeForHTML method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForHTMLAttribute()
-
-- Test of encodeForHTMLAttribute method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForJavascript()
-
-- Test of encodeForJavaScript method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForLDAP()
-
-- Test of encodeForLDAP method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForSQL()
-
-- Test of encodeForSQL method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForURL()
-
-- Test of encodeForURL method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForVBScript()
-
-- Test of encodeForVisualBasicScript method, of class - org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForXML()
-
-- Test of encodeForXML method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForXMLAttribute()
-
-- Test of encodeForXMLAttribute method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForXPath()
-
-- Test of encodeForXPath method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEntityEncode()
-
-- |
-
- void |
-testNormalize()
-
-- Test of normalize method, of class org.owasp.esapi.Validator. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-EncoderTest
--public EncoderTest(java.lang.String testName)-
-
-
- Instantiates a new encoder test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testCanonicalize
--public void testCanonicalize() - throws EncodingException-
-
-
- Test of canonicalize method, of class org.owasp.esapi.Validator.
-
-
-
-
-
- Throws: -
ValidationException-EncodingException
- -
-testNormalize
--public void testNormalize() - throws ValidationException-
-
-
- Test of normalize method, of class org.owasp.esapi.Validator.
-
-
-
-
-
- Throws: -
ValidationException- the validation exception
- -
-testEntityEncode
--public void testEntityEncode()-
-
-
-
-
-
- -
-testEncodeForHTML
--public void testEncodeForHTML()-
-
-
- Test of encodeForHTML method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForHTMLAttribute
--public void testEncodeForHTMLAttribute()-
-
-
- Test of encodeForHTMLAttribute method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForJavascript
--public void testEncodeForJavascript()-
-
-
- Test of encodeForJavaScript method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForVBScript
--public void testEncodeForVBScript()-
-
-
- Test of encodeForVisualBasicScript method, of class
- org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForXPath
--public void testEncodeForXPath()-
-
-
- Test of encodeForXPath method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForSQL
--public void testEncodeForSQL()-
-
-
- Test of encodeForSQL method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForLDAP
--public void testEncodeForLDAP()-
-
-
- Test of encodeForLDAP method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForDN
--public void testEncodeForDN()-
-
-
- Test of encodeForLDAP method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForXML
--public void testEncodeForXML()-
-
-
- Test of encodeForXML method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForXMLAttribute
--public void testEncodeForXMLAttribute()-
-
-
- Test of encodeForXMLAttribute method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForURL
--public void testEncodeForURL() - throws java.lang.Exception-
-
-
- Test of encodeForURL method, of class org.owasp.esapi.Encoder.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testDecodeFromURL
--public void testDecodeFromURL() - throws java.lang.Exception-
-
-
- Test of decodeFromURL method, of class org.owasp.esapi.Encoder.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testEncodeForBase64
--public void testEncodeForBase64()-
-
-
- Test of encodeForBase64 method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testDecodeFromBase64
--public void testDecodeFromBase64()-
-
-
- Test of decodeFromBase64 method, of class org.owasp.esapi.Encoder.
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/EncodingException.html b/javadoc/org/owasp/esapi/EncodingException.html deleted file mode 100644 index 29e6cadd7..000000000 --- a/javadoc/org/owasp/esapi/EncodingException.html +++ /dev/null @@ -1,277 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class EncodingException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class EncodingException
- extends EnterpriseSecurityException
-An ExecutorException should be thrown for any problems that occur when - encoding or decoding data. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
EncodingException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EncodingException. |
-|
EncodingException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new EncodingException. |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-EncodingException
--public EncodingException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EncodingException.
-
-
- -
-EncodingException
--public EncodingException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new EncodingException.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/EncryptedProperties.html b/javadoc/org/owasp/esapi/EncryptedProperties.html deleted file mode 100644 index 74040dff3..000000000 --- a/javadoc/org/owasp/esapi/EncryptedProperties.html +++ /dev/null @@ -1,337 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface EncryptedProperties
--
-
- All Known Implementing Classes:
- DefaultEncryptedProperties -
-
-
-
- public interface EncryptedProperties
-The EncryptedProperties interface represents a properties file where all the data is - encrypted before it is added, and decrypted when it retrieved. This interface can be - implemented in a number of ways, the simplest being extending Properties and overloading - the getProperty and setProperty methods. -
- 
-
-
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- java.lang.String |
-getProperty(java.lang.String key)
-
-- Gets the property value from the encrypted store, decrypts it, and returns the plaintext value to the caller. |
-
- java.util.Set |
-keySet()
-
-- Key set. |
-
- void |
-load(java.io.InputStream in)
-
-- Load. |
-
- java.lang.String |
-setProperty(java.lang.String key,
- java.lang.String value)
-
-- Encrypts the plaintext property value and stores the ciphertext value in the encrypted store. |
-
- void |
-store(java.io.OutputStream out,
- java.lang.String comments)
-
-- Store. |
-
| -Method Detail | -
-getProperty
--public java.lang.String getProperty(java.lang.String key) - throws EncryptionException-
-
-
- Gets the property value from the encrypted store, decrypts it, and returns the plaintext value to the caller.
-
-
-
-
- Parameters:
key- the key -- Returns:
- the decrypted property value -
- Throws: -
EncryptionException- the encryption exception
- -
-setProperty
--public java.lang.String setProperty(java.lang.String key, - java.lang.String value) - throws EncryptionException-
-
-
- Encrypts the plaintext property value and stores the ciphertext value in the encrypted store.
-
-
-
-
- Parameters:
key- the keyvalue- the value -- Returns:
- the encrypted property value -
- Throws: -
EncryptionException- the encryption exception
- -
-keySet
--public java.util.Set keySet()-
-
-
- Key set.
-
-
-
-
-
- Returns:
- the set
- -
-load
--public void load(java.io.InputStream in) - throws java.io.IOException-
-
-
- Load.
-
-
-
-
- Parameters:
in- the in -- Throws: -
java.io.IOException- Signals that an I/O exception has occurred.
- -
-store
--public void store(java.io.OutputStream out, - java.lang.String comments) - throws java.io.IOException-
-
-
- Store.
-
-
-
-
- Parameters:
out- the outcomments- the comments -- Throws: -
java.io.IOException- Signals that an I/O exception has occurred.
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/EncryptedPropertiesTest.html b/javadoc/org/owasp/esapi/EncryptedPropertiesTest.html deleted file mode 100644 index fd0dc2bf1..000000000 --- a/javadoc/org/owasp/esapi/EncryptedPropertiesTest.html +++ /dev/null @@ -1,432 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class EncryptedPropertiesTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class EncryptedPropertiesTest
- extends junit.framework.TestCase
-The Class EncryptedPropertiesTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
EncryptedPropertiesTest(java.lang.String testName)
-
-- Instantiates a new encrypted properties test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testGetProperty()
-
-- Test of getProperty method, of class org.owasp.esapi.EncryptedProperties. |
-
- void |
-testKeySet()
-
-- Test of keySet method, of class org.owasp.esapi.EncryptedProperties. |
-
- void |
-testLoad()
-
-- Test of load method, of class org.owasp.esapi.EncryptedProperties. |
-
- void |
-testMain()
-
-- Test of store method, of class org.owasp.esapi.EncryptedProperties. |
-
- void |
-testSetProperty()
-
-- Test of setProperty method, of class org.owasp.esapi.EncryptedProperties. |
-
- void |
-testStore()
-
-- Test of store method, of class org.owasp.esapi.EncryptedProperties. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-EncryptedPropertiesTest
--public EncryptedPropertiesTest(java.lang.String testName)-
-
-
- Instantiates a new encrypted properties test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testGetProperty
--public void testGetProperty() - throws EncryptionException-
-
-
- Test of getProperty method, of class org.owasp.esapi.EncryptedProperties.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception
- -
-testSetProperty
--public void testSetProperty() - throws EncryptionException-
-
-
- Test of setProperty method, of class org.owasp.esapi.EncryptedProperties.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception
- -
-testKeySet
--public void testKeySet() - throws java.lang.Exception-
-
-
- Test of keySet method, of class org.owasp.esapi.EncryptedProperties.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testLoad
--public void testLoad() - throws java.lang.Exception-
-
-
- Test of load method, of class org.owasp.esapi.EncryptedProperties.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testStore
--public void testStore() - throws java.lang.Exception-
-
-
- Test of store method, of class org.owasp.esapi.EncryptedProperties.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testMain
--public void testMain() - throws java.lang.Exception-
-
-
- Test of store method, of class org.owasp.esapi.EncryptedProperties.
-
-
-
-
-
- Throws: -
java.lang.Exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/EncryptionException.html b/javadoc/org/owasp/esapi/EncryptionException.html deleted file mode 100644 index 3f62ce292..000000000 --- a/javadoc/org/owasp/esapi/EncryptionException.html +++ /dev/null @@ -1,277 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class EncryptionException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class EncryptionException
- extends EnterpriseSecurityException
-An EncryptionException should be thrown for any problems related to - encryption, hashing, or digital signatures. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
EncryptionException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EncryptionException. |
-|
EncryptionException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new EncryptionException. |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-EncryptionException
--public EncryptionException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EncryptionException.
-
-
- -
-EncryptionException
--public EncryptionException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new EncryptionException.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/Encryptor.html b/javadoc/org/owasp/esapi/Encryptor.html deleted file mode 100644 index 588dcd5e2..000000000 --- a/javadoc/org/owasp/esapi/Encryptor.html +++ /dev/null @@ -1,491 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface Encryptor
--
-
- All Known Implementing Classes:
- JavaEncryptor -
-
-
-
- public interface Encryptor
-The Encryptor interface provides a set of methods for performing common - encryption, random number, and hashing operations. Implementations should - rely on a strong cryptographic implementation, such as JCE or BouncyCastle. - Implementors should take care to ensure that they initialize their - implementation with a strong "master key", and that they protect this secret - as much as possible. -
- 
-
- Possible future enhancements (depending on feedback) might include: -
-
-
- encryptFile -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- java.lang.String |
-decrypt(java.lang.String ciphertext)
-
-- Decrypts the provided ciphertext string (encrypted with the encrypt - method) and returns a plaintext string. |
-
- java.lang.String |
-encrypt(java.lang.String plaintext)
-
-- Encrypts the provided plaintext and returns a ciphertext string. |
-
- long |
-getRelativeTimeStamp(long offset)
-
-- Gets an absolute timestamp representing an offset from the current time to be used by - other functions in the library. |
-
- long |
-getTimeStamp()
-
-- Gets a timestamp representing the current date and time to be used by - other functions in the library. |
-
- java.lang.String |
-hash(java.lang.String plaintext,
- java.lang.String salt)
-
-- Returns a string representation of the hash of the provided plaintext and - salt. |
-
- java.lang.String |
-seal(java.lang.String data,
- long timestamp)
-
-- Creates a seal that binds a set of data and includes an expiration timestamp. |
-
- java.lang.String |
-sign(java.lang.String data)
-
-- Create a digital signature for the provided data and return it in a - string. |
-
- java.lang.String |
-unseal(java.lang.String seal)
-
-- Unseals data (created with the seal method) and throws an exception - describing any of the various problems that could exist with a seal, such - as an invalid seal format, expired timestamp, or decryption error. |
-
- boolean |
-verifySeal(java.lang.String seal)
-
-- Verifies a seal (created with the seal method) and throws an exception - describing any of the various problems that could exist with a seal, such - as an invalid seal format, expired timestamp, or data mismatch. |
-
- boolean |
-verifySignature(java.lang.String signature,
- java.lang.String data)
-
-- Verifies a digital signature (created with the sign method) and returns - the boolean result. |
-
| -Method Detail | -
-hash
--public java.lang.String hash(java.lang.String plaintext, - java.lang.String salt) - throws EncryptionException-
-
-
- Returns a string representation of the hash of the provided plaintext and
- salt. The salt helps to protect against a rainbow table attack by mixing
- in some extra data with the plaintext. Some good choices for a salt might
- be an account name or some other string that is known to the application
- but not to an attacker. See this article for
- more information about hashing as it pertains to password schemes.
-
-
-
-
- Parameters:
plaintext- the plaintext String to encryptsalt- the salt -- Returns:
- the encrypted hash of 'plaintext' stored as a String -
- Throws: -
EncryptionException- the encryption exception
- -
-encrypt
--public java.lang.String encrypt(java.lang.String plaintext) - throws EncryptionException-
-
-
- Encrypts the provided plaintext and returns a ciphertext string.
-
-
-
-
- Parameters:
plaintext- the plaintext String to encrypt -- Returns:
- the encrypted String -
- Throws: -
EncryptionException- the encryption exception
- -
-decrypt
--public java.lang.String decrypt(java.lang.String ciphertext) - throws EncryptionException-
-
-
- Decrypts the provided ciphertext string (encrypted with the encrypt
- method) and returns a plaintext string.
-
-
-
-
- Parameters:
ciphertext- the ciphertext -- Returns:
- the decrypted ciphertext -
- Throws: -
EncryptionException- the encryption exception
- -
-sign
--public java.lang.String sign(java.lang.String data) - throws EncryptionException-
-
-
- Create a digital signature for the provided data and return it in a
- string.
-
-
-
-
- Parameters:
data- the data to sign -- Returns:
- the digital signature stored as a String -
- Throws: -
EncryptionException- the encryption exception
- -
-verifySignature
--public boolean verifySignature(java.lang.String signature, - java.lang.String data)-
-
-
- Verifies a digital signature (created with the sign method) and returns
- the boolean result.
-
-
-
-
- Parameters:
signature- the signature to verifydata- the data to verify -- Returns:
- true, if the signature is verified -
- Throws: -
EncryptionException- the encryption exception
- -
-seal
--public java.lang.String seal(java.lang.String data, - long timestamp) - throws IntegrityException-
-
-
- Creates a seal that binds a set of data and includes an expiration timestamp.
-
-
-
-
- Parameters:
data- the data to sealtimestamp- the absolute expiration date of the data, expressed as seconds since the epoch -- Returns:
- the seal -
- Throws: -
EncryptionException- the encryption exception -IntegrityException
- -
-unseal
--public java.lang.String unseal(java.lang.String seal) - throws EncryptionException-
-
-
- Unseals data (created with the seal method) and throws an exception
- describing any of the various problems that could exist with a seal, such
- as an invalid seal format, expired timestamp, or decryption error.
-
-
-
-
- Parameters:
seal- the sealed data -- Returns:
- the original data -
- Throws: -
ExcryptionException- if the unsealed data cannot be retrieved for any reason -EncryptionException
- -
-verifySeal
--public boolean verifySeal(java.lang.String seal)-
-
-
- Verifies a seal (created with the seal method) and throws an exception
- describing any of the various problems that could exist with a seal, such
- as an invalid seal format, expired timestamp, or data mismatch.
-
-
-
-
- Parameters:
seal- the seal -- Returns:
- true, if the seal is valid
- -
-getRelativeTimeStamp
--public long getRelativeTimeStamp(long offset)-
-
-
- Gets an absolute timestamp representing an offset from the current time to be used by
- other functions in the library.
-
-
-
-
- Parameters:
offset- the offset to add to the current time -- Returns:
- the absolute timestamp
- -
-getTimeStamp
--public long getTimeStamp()-
-
-
- Gets a timestamp representing the current date and time to be used by
- other functions in the library.
-
-
-
-
-
- Returns:
- the timestamp
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/EncryptorTest.html b/javadoc/org/owasp/esapi/EncryptorTest.html deleted file mode 100644 index 52814926a..000000000 --- a/javadoc/org/owasp/esapi/EncryptorTest.html +++ /dev/null @@ -1,455 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class EncryptorTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class EncryptorTest
- extends junit.framework.TestCase
-The Class EncryptorTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
EncryptorTest(java.lang.String testName)
-
-- Instantiates a new encryptor test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testDecrypt()
-
-- Test of decrypt method, of class org.owasp.esapi.Encryptor. |
-
- void |
-testEncrypt()
-
-- Test of encrypt method, of class org.owasp.esapi.Encryptor. |
-
- void |
-testHash()
-
-- Test of hash method, of class org.owasp.esapi.Encryptor. |
-
- void |
-testSeal()
-
-- Test of seal method, of class org.owasp.esapi.Encryptor. |
-
- void |
-testSign()
-
-- Test of sign method, of class org.owasp.esapi.Encryptor. |
-
- void |
-testVerifySeal()
-
-- Test of verifySeal method, of class org.owasp.esapi.Encryptor. |
-
- void |
-testVerifySignature()
-
-- Test of verifySignature method, of class org.owasp.esapi.Encryptor. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-EncryptorTest
--public EncryptorTest(java.lang.String testName)-
-
-
- Instantiates a new encryptor test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testHash
--public void testHash() - throws EncryptionException-
-
-
- Test of hash method, of class org.owasp.esapi.Encryptor.
-
-
-
-
-
- Throws: -
EncryptionException
- -
-testEncrypt
--public void testEncrypt() - throws EncryptionException-
-
-
- Test of encrypt method, of class org.owasp.esapi.Encryptor.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception
- -
-testDecrypt
--public void testDecrypt()-
-
-
- Test of decrypt method, of class org.owasp.esapi.Encryptor.
-
-
-
-
- -
-testSign
--public void testSign() - throws EncryptionException-
-
-
- Test of sign method, of class org.owasp.esapi.Encryptor.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception
- -
-testVerifySignature
--public void testVerifySignature() - throws EncryptionException-
-
-
- Test of verifySignature method, of class org.owasp.esapi.Encryptor.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception
- -
-testSeal
--public void testSeal() - throws IntegrityException-
-
-
- Test of seal method, of class org.owasp.esapi.Encryptor.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception -IntegrityException
- -
-testVerifySeal
--public void testVerifySeal() - throws EnterpriseSecurityException-
-
-
- Test of verifySeal method, of class org.owasp.esapi.Encryptor.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception -EnterpriseSecurityException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/EnterpriseSecurityException.html b/javadoc/org/owasp/esapi/EnterpriseSecurityException.html deleted file mode 100644 index fe4733e9d..000000000 --- a/javadoc/org/owasp/esapi/EnterpriseSecurityException.html +++ /dev/null @@ -1,334 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class EnterpriseSecurityException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
- Direct Known Subclasses:
- AccessControlException, AuthenticationException, AvailabilityException, CertificateException, EncodingException, EncryptionException, ExecutorException, IntegrityException, ValidationException -
-
-
-
- public class EnterpriseSecurityException
- extends java.lang.Exception
-EnterpriseSecurityException is the base class for all security related exceptions. You should pass in the root cause - exception where possible. Constructors for classes extending EnterpriseSecurityException should be sure to call the - appropriate super() method in order to ensure that logging and intrusion detection occur properly. -
- All EnterpriseSecurityExceptions have two messages, one for the user and one for the log file. This way, a message - can be shown to the user that doesn't contain sensitive information or unnecessary implementation details. Meanwhile, - all the critical information can be included in the exception so that it gets logged. -
- Note that the "logMessage" for ALL EnterpriseSecurityExceptions is logged in the log file. This feature should be - used extensively throughout ESAPI implementations and the result is a fairly complete set of security log records. - ALL EnterpriseSecurityExceptions are also sent to the IntrusionDetector for use in detecting anomolous patterns of - application usage. -
-
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
EnterpriseSecurityException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EnterpriseSecurityException. |
-|
EnterpriseSecurityException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Creates a new instance of EnterpriseSecurityException that includes a root cause Throwable. |
-|
| -Method Summary | -|
- java.lang.String |
-getLogMessage()
-
-- |
-
- java.lang.String |
-getUserMessage()
-
-- |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-EnterpriseSecurityException
--public EnterpriseSecurityException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EnterpriseSecurityException. This exception is automatically logged, so that simply by
- using this API, applications will generate an extensive security log. In addition, this exception is
- automatically registered with the IntrusionDetector, so that quotas can be checked.
-
-
- -
-EnterpriseSecurityException
--public EnterpriseSecurityException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Creates a new instance of EnterpriseSecurityException that includes a root cause Throwable.
-
-
- Parameters:
cause- the cause
| -Method Detail | -
-getUserMessage
--public java.lang.String getUserMessage()-
-
-
-
-
-
- -
-getLogMessage
--public java.lang.String getLogMessage()-
-
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/Executor.html b/javadoc/org/owasp/esapi/Executor.html deleted file mode 100644 index e25c8a67b..000000000 --- a/javadoc/org/owasp/esapi/Executor.html +++ /dev/null @@ -1,253 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface Executor
--
-
- All Known Implementing Classes:
- DefaultExecutor -
-
-
-
- public interface Executor
-The Executor interface is used to run an OS command with reduced security risk. - Implementations should do as much as possible to minimize the risk of - injection into either the command or parameters. In addition, implementations - should timeout after a specified time period in order to help prevent denial - of service attacks. The class should perform logging and error handling as - well. Finally, implementation should handle errors and generate an - ExecutorException with all the necessary information. -
- 
-
-
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- java.lang.String |
-executeSystemCommand(java.io.File executable,
- java.util.List params,
- java.io.File workdir,
- int timeoutSeconds)
-
-- Executes a system command after checking that the executable exists and - that the parameters have not been subject to injection with untrusted - user data. |
-
| -Method Detail | -
-executeSystemCommand
--public java.lang.String executeSystemCommand(java.io.File executable, - java.util.List params, - java.io.File workdir, - int timeoutSeconds) - throws ExecutorException-
-
-
- Executes a system command after checking that the executable exists and
- that the parameters have not been subject to injection with untrusted
- user data. Implementations shall change to the specified working
- directory before invoking the command. Also, processes should be
- interrupted after the specified timeout period has elapsed.
-
-
-
-
- Parameters:
params- the parameters of the command being executedworkdir- the working directorytimeoutSeconds- the amount of time to allow this process to run -- Returns:
- the output of the command being run -
- Throws: -
ExecutorException- the service exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/ExecutorException.html b/javadoc/org/owasp/esapi/ExecutorException.html deleted file mode 100644 index 89b717f33..000000000 --- a/javadoc/org/owasp/esapi/ExecutorException.html +++ /dev/null @@ -1,277 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class ExecutorException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class ExecutorException
- extends EnterpriseSecurityException
-An ExecutorException should be thrown for any problems that arise during the - execution of a system executable. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
ExecutorException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of ExecutorException. |
-|
ExecutorException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new ExecutorException. |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ExecutorException
--public ExecutorException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of ExecutorException.
-
-
- -
-ExecutorException
--public ExecutorException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new ExecutorException.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/ExecutorTest.html b/javadoc/org/owasp/esapi/ExecutorTest.html deleted file mode 100644 index 4de6b8a1b..000000000 --- a/javadoc/org/owasp/esapi/ExecutorTest.html +++ /dev/null @@ -1,312 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class ExecutorTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class ExecutorTest
- extends junit.framework.TestCase
-The Class ExecutorTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
ExecutorTest(java.lang.String testName)
-
-- Instantiates a new executor test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testExecuteSystemCommand()
-
-- Test of executeOSCommand method, of class org.owasp.esapi.Executor |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ExecutorTest
--public ExecutorTest(java.lang.String testName)-
-
-
- Instantiates a new executor test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testExecuteSystemCommand
--public void testExecuteSystemCommand() - throws java.lang.Exception-
-
-
- Test of executeOSCommand method, of class org.owasp.esapi.Executor
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/HTTPUtilities.html b/javadoc/org/owasp/esapi/HTTPUtilities.html deleted file mode 100644 index dcd228b1c..000000000 --- a/javadoc/org/owasp/esapi/HTTPUtilities.html +++ /dev/null @@ -1,910 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface HTTPUtilities
--
-
- All Known Implementing Classes:
- DefaultHTTPUtilities -
-
-
-
- public interface HTTPUtilities
-The HTTPUtilities interface is a collection of methods that provide additional security related to HTTP requests, - responses, sessions, cookies, headers, and logging. -
- 
-
-
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Field Summary | -|
-static java.lang.String |
-REMEMBER_TOKEN_COOKIE_NAME
-
-- Key for remember token cookie |
-
| -Method Summary | -|
- java.lang.String |
-addCSRFToken(java.lang.String href)
-
-- Adds the current user's CSRF token (see User.getCSRFToken()) to the URL for purposes of preventing CSRF attacks. |
-
- void |
-assertSecureRequest(javax.servlet.http.HttpServletRequest request)
-
-- Ensures that the current request uses SSL and POST to protect any sensitive parameters - in the querystring from being sniffed or logged. |
-
- javax.servlet.http.HttpSession |
-changeSessionIdentifier(javax.servlet.http.HttpServletRequest request)
-
-- Invalidate the old session after copying all of its contents to a newly created session with a new session id. |
-
- java.lang.String |
-decryptHiddenField(java.lang.String encrypted)
-
-- Decrypts an encrypted hidden field value and returns the cleartext. |
-
- java.util.Map |
-decryptQueryString(java.lang.String encrypted)
-
-- Takes an encrypted querystring and returns a Map containing the original parameters. |
-
- java.util.Map |
-decryptStateFromCookie(javax.servlet.http.HttpServletRequest request)
-
-- Retrieves a map of data from a cookie encrypted with encryptStateInCookie(). |
-
- java.lang.String |
-encryptHiddenField(java.lang.String value)
-
-- Encrypts a hidden field value for use in HTML. |
-
- java.lang.String |
-encryptQueryString(java.lang.String query)
-
-- Takes a querystring (i.e. |
-
- void |
-encryptStateInCookie(javax.servlet.http.HttpServletResponse response,
- java.util.Map cleartext)
-
-- Stores a Map of data in an encrypted cookie. |
-
- javax.servlet.http.Cookie |
-getCookie(javax.servlet.http.HttpServletRequest request,
- java.lang.String name)
-
-- Get the first cookie with the matching name. |
-
- java.lang.String |
-getCSRFToken()
-
-- Returns the current user's CSRF token. |
-
- SafeRequest |
-getCurrentRequest()
-
-- Retrieves the current HttpServletRequest |
-
- SafeResponse |
-getCurrentResponse()
-
-- Retrieves the current HttpServletResponse |
-
- java.util.List |
-getSafeFileUploads(javax.servlet.http.HttpServletRequest request,
- java.io.File tempDir,
- java.io.File finalDir)
-
-- Extract uploaded files from a multipart HTTP requests. |
-
- void |
-killAllCookies(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- Kill all cookies received in the last request from the browser. |
-
- void |
-killCookie(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response,
- java.lang.String name)
-
-- Kills the specified cookie by setting a new cookie that expires immediately. |
-
- void |
-logHTTPRequest(javax.servlet.http.HttpServletRequest request,
- Logger logger)
-
-- Format the Source IP address, URL, URL parameters, and all form - parameters into a string suitable for the log file. |
-
- void |
-logHTTPRequest(javax.servlet.http.HttpServletRequest request,
- Logger logger,
- java.util.List parameterNamesToObfuscate)
-
-- Format the Source IP address, URL, URL parameters, and all form - parameters into a string suitable for the log file. |
-
- void |
-safeSendForward(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response,
- java.lang.String context,
- java.lang.String location)
-
-- This method perform a forward to any resource located inside the WEB-INF directory. |
-
- void |
-safeSetContentType(javax.servlet.http.HttpServletResponse response)
-
-- Sets the content type on each HTTP response, to help protect against cross-site scripting attacks and other types - of injection into HTML documents. |
-
- void |
-setCurrentHTTP(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- Stores the current HttpRequest and HttpResponse so that they may be readily accessed throughout - ESAPI (and elsewhere) |
-
- void |
-setNoCacheHeaders(javax.servlet.http.HttpServletResponse response)
-
-- Set headers to protect sensitive information against being cached in the browser. |
-
- java.lang.String |
-setRememberToken(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response,
- java.lang.String password,
- int maxAge,
- java.lang.String domain,
- java.lang.String path)
-
-- Set a cookie containing the current User's remember me token for automatic authentication. |
-
- void |
-verifyCSRFToken(javax.servlet.http.HttpServletRequest request)
-
-- Checks the CSRF token in the URL (see User.getCSRFToken()) against the user's CSRF token and - throws an IntrusionException if it is missing. |
-
| -Field Detail | -
-REMEMBER_TOKEN_COOKIE_NAME
--public static final java.lang.String REMEMBER_TOKEN_COOKIE_NAME-
-
-
- Key for remember token cookie
-
-
-
-
- See Also:
- Constant Field Values
| -Method Detail | -
-assertSecureRequest
--public void assertSecureRequest(javax.servlet.http.HttpServletRequest request) - throws AccessControlException-
-
-
- Ensures that the current request uses SSL and POST to protect any sensitive parameters
- in the querystring from being sniffed or logged. For example, this method should
- be called from any method that uses sensitive data from a web form.
-
- This method uses
getCurrentRequest()to obtain the currentHttpServletRequestobject --
-
-
-
- Throws: -
AccessControlException- if security constraints are not met
- -
-addCSRFToken
--public java.lang.String addCSRFToken(java.lang.String href)-
-
-
- Adds the current user's CSRF token (see User.getCSRFToken()) to the URL for purposes of preventing CSRF attacks.
- This method should be used on all URLs to be put into all links and forms the application generates.
-
-
-
-
- Parameters:
href- the URL to which the CSRF token will be appended -- Returns:
- the updated URL with the CSRF token parameter added
- -
-getCookie
--public javax.servlet.http.Cookie getCookie(javax.servlet.http.HttpServletRequest request, - java.lang.String name)-
-
-
- Get the first cookie with the matching name.
-
-
-
-
- Parameters:
name- -- Returns:
- -
-getCSRFToken
--public java.lang.String getCSRFToken()-
-
-
- Returns the current user's CSRF token. If there is no current user then return null.
-
-
-
-
-
- Returns:
- the current users CSRF token
- -
-changeSessionIdentifier
--public javax.servlet.http.HttpSession changeSessionIdentifier(javax.servlet.http.HttpServletRequest request) - throws AuthenticationException-
-
-
- Invalidate the old session after copying all of its contents to a newly created session with a new session id.
- Note that this is different from logging out and creating a new session identifier that does not contain the
- existing session contents. Care should be taken to use this only when the existing session does not contain
- hazardous contents.
-
- This method uses
getCurrentRequest()to obtain the currentHttpSessionobject --
-
-
-
- Returns:
- the new HttpSession with a changed id -
- Throws: -
EnterpriseSecurityException- the enterprise security exception -AuthenticationException
- -
-verifyCSRFToken
--public void verifyCSRFToken(javax.servlet.http.HttpServletRequest request) - throws IntrusionException-
-
-
- Checks the CSRF token in the URL (see User.getCSRFToken()) against the user's CSRF token and
- throws an IntrusionException if it is missing.
-
-
-
-
-
- Throws: -
IntrusionException- if CSRF token is missing or incorrect
- -
-decryptHiddenField
--public java.lang.String decryptHiddenField(java.lang.String encrypted)-
-
-
- Decrypts an encrypted hidden field value and returns the cleartext. If the field does not decrypt properly,
- an IntrusionException is thrown to indicate tampering.
-
-
-
-
- Parameters:
encrypted- hidden field value to decrypt -- Returns:
- decrypted hidden field value stored as a String
- -
-setRememberToken
--public java.lang.String setRememberToken(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response, - java.lang.String password, - int maxAge, - java.lang.String domain, - java.lang.String path)-
-
-
- Set a cookie containing the current User's remember me token for automatic authentication. The use of remember me tokens
- is generally not recommended, but this method will help do it as safely as possible. The user interface should strongly warn
- the user that this should only be enabled on computers where no other users will have access.
-
- The username can be retrieved with: User username = ESAPI.authenticator().getCurrentUser();
-
-
-
-
- Parameters:
password- the user's passwordmaxAge- the length of time that the token should be valid for in relative secondsdomain- the domain to restrict the token to or nullpath- the path to restrict the token to or null -- Returns:
- encrypted "Remember Me" token stored as a String
- -
-encryptHiddenField
--public java.lang.String encryptHiddenField(java.lang.String value) - throws EncryptionException-
-
-
- Encrypts a hidden field value for use in HTML.
-
-
-
-
- Parameters:
value- the cleartext value of the hidden field -- Returns:
- the encrypted value of the hidden field -
- Throws: -
EncryptionException
- -
-encryptQueryString
--public java.lang.String encryptQueryString(java.lang.String query) - throws EncryptionException-
-
-
- Takes a querystring (i.e. everything after the ? in the URL) and returns an encrypted string containing the parameters.
-
-
-
-
- Parameters:
query- the querystring to encrypt -- Returns:
- encrypted querystring stored as a String -
- Throws: -
EncryptionException
- -
-decryptQueryString
--public java.util.Map decryptQueryString(java.lang.String encrypted) - throws EncryptionException-
-
-
- Takes an encrypted querystring and returns a Map containing the original parameters.
-
-
-
-
- Parameters:
encrypted- the encrypted querystring to decrypt -- Returns:
- a Map object containing the decrypted querystring -
- Throws: -
EncryptionException
- -
-getSafeFileUploads
--public java.util.List getSafeFileUploads(javax.servlet.http.HttpServletRequest request, - java.io.File tempDir, - java.io.File finalDir) - throws ValidationException-
-
-
- Extract uploaded files from a multipart HTTP requests. Implementations must check the content to ensure that it
- is safe before making a permanent copy on the local filesystem. Checks should include length and content checks,
- possibly virus checking, and path and name checks. Refer to the file checking methods in Validator for more
- information.
-
- This method uses
getCurrentRequest()to obtain theHttpServletRequestobject --
-
-
- Parameters:
tempDir- the temporary directoryfinalDir- the final directory -- Returns:
- List of new File objects from upload -
- Throws: -
ValidationException- if the file fails validation
- -
-decryptStateFromCookie
--public java.util.Map decryptStateFromCookie(javax.servlet.http.HttpServletRequest request) - throws EncryptionException-
-
-
- Retrieves a map of data from a cookie encrypted with encryptStateInCookie().
-
-
-
-
-
- Returns:
- a map containing the decrypted cookie state value -
- Throws: -
EncryptionException
- -
-killAllCookies
--public void killAllCookies(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response)-
-
-
- Kill all cookies received in the last request from the browser. Note that new cookies set by the application in
- this response may not be killed by this method.
-
-
-
-
- -
-killCookie
--public void killCookie(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response, - java.lang.String name)-
-
-
- Kills the specified cookie by setting a new cookie that expires immediately. Note that this
- method does not delete new cookies that are being set by the application for this response.
-
-
-
-
- -
-encryptStateInCookie
--public void encryptStateInCookie(javax.servlet.http.HttpServletResponse response, - java.util.Map cleartext) - throws EncryptionException-
-
-
- Stores a Map of data in an encrypted cookie. Generally the session is a better
- place to store state information, as it does not expose it to the user at all.
- If there is a requirement not to use sessions, or the data should be stored
- across sessions (for a long time), the use of encrypted cookies is an effective
- way to prevent the exposure.
-
-
-
-
-
- Throws: -
EncryptionException
- -
-safeSendForward
--public void safeSendForward(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response, - java.lang.String context, - java.lang.String location) - throws AccessControlException, - javax.servlet.ServletException, - java.io.IOException-
-
-
- This method perform a forward to any resource located inside the WEB-INF directory. Forwarding to
- publicly accessible resources can be dangerous, as the request will have already passed the URL
- based access control check. This method ensures that you can only forward to non-publicly
- accessible resources.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.location- the URL to forward to -- Throws: -
AccessControlException-javax.servlet.ServletException-java.io.IOException
- -
-safeSetContentType
--public void safeSetContentType(javax.servlet.http.HttpServletResponse response)-
-
-
- Sets the content type on each HTTP response, to help protect against cross-site scripting attacks and other types
- of injection into HTML documents.
-
-
-
-
- -
-setNoCacheHeaders
--public void setNoCacheHeaders(javax.servlet.http.HttpServletResponse response)-
-
-
- Set headers to protect sensitive information against being cached in the browser. Developers should make this
- call for any HTTP responses that contain any sensitive data that should not be cached within the browser or any
- intermediate proxies or caches. Implementations should set headers for the expected browsers. The safest approach
- is to set all relevant headers to their most restrictive setting. These include:
-
-
- - Cache-Control: no-store
- - Note that the header "pragma: no-cache" is only useful in HTTP requests, not HTTP responses. So even though there - are many articles recommending the use of this header, it is not helpful for preventing browser caching. For more - information, please refer to the relevant standards: -
- Cache-Control: no-cache
- Cache-Control: must-revalidate
- Expires: -1
- --
-
- HTTP/1.1 Cache-Control "no-cache" -
- HTTP/1.1 Cache-Control "no-store" -
- HTTP/1.0 Pragma "no-cache" -
- HTTP/1.0 Expires -
- IE6 Caching Issues -
- Firefox browser.cache.disk_cache_ssl -
- Mozilla -
getCurrentResponse()to obtain theHttpServletResponseobject --
-
-
- -
-setCurrentHTTP
--public void setCurrentHTTP(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response)-
-
-
- Stores the current HttpRequest and HttpResponse so that they may be readily accessed throughout
- ESAPI (and elsewhere)
-
-
-
-
- Parameters:
request- the current requestresponse- the current response
- -
-getCurrentRequest
--public SafeRequest getCurrentRequest()-
-
-
- Retrieves the current HttpServletRequest
-
-
-
-
-
- Returns:
- the current request
- -
-getCurrentResponse
--public SafeResponse getCurrentResponse()-
-
-
- Retrieves the current HttpServletResponse
-
-
-
-
-
- Returns:
- the current response
- -
-logHTTPRequest
--public void logHTTPRequest(javax.servlet.http.HttpServletRequest request, - Logger logger)-
-
-
- Format the Source IP address, URL, URL parameters, and all form
- parameters into a string suitable for the log file. Be careful not
- to log sensitive information, and consider masking with the
- logHTTPRequest( List parameterNamesToObfuscate ) method.
-
-
-
-
- Parameters:
logger- the logger to write the request to
- -
-logHTTPRequest
--public void logHTTPRequest(javax.servlet.http.HttpServletRequest request, - Logger logger, - java.util.List parameterNamesToObfuscate)-
-
-
- Format the Source IP address, URL, URL parameters, and all form
- parameters into a string suitable for the log file. The list of parameters to
- obfuscate should be specified in order to prevent sensitive information
- from being logged. If a null list is provided, then all parameters will
- be logged. If HTTP request logging is done in a central place, the
- parameterNamesToObfuscate could be made a configuration parameter. We
- include it here in case different parts of the application need to obfuscate
- different parameters.
-
- This method uses
getCurrentResponse()to obtain theHttpServletResponseobject --
-
-
- Parameters:
logger- the logger to write the request toparameterNamesToObfuscate- the sensitive parameters
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/HTTPUtilitiesTest.html b/javadoc/org/owasp/esapi/HTTPUtilitiesTest.html deleted file mode 100644 index da1ec5cc7..000000000 --- a/javadoc/org/owasp/esapi/HTTPUtilitiesTest.html +++ /dev/null @@ -1,532 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class HTTPUtilitiesTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class HTTPUtilitiesTest
- extends junit.framework.TestCase
-The Class HTTPUtilitiesTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
HTTPUtilitiesTest(java.lang.String testName)
-
-- Instantiates a new HTTP utilities test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testAddCSRFToken()
-
-- Test of addCSRFToken method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testChangeSessionIdentifier()
-
-- Test of sendRedirect method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testGetFileUploads()
-
-- Test of formatHttpRequestForLog method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testGetStateFromEncryptedCookie()
-
-- |
-
- void |
-testIsValidHTTPRequest()
-
-- Test of isValidHTTPRequest method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testKillAllCookies()
-
-- Test of killAllCookies method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testKillCookie()
-
-- Test of killCookie method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testSaveStateInEncryptedCookie()
-
-- |
-
- void |
-testSendSafeRedirect()
-
-- Test of sendRedirect method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testSetCookie()
-
-- Test of setCookie method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testSetNoCacheHeaders()
-
-- Test set no cache headers. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-HTTPUtilitiesTest
--public HTTPUtilitiesTest(java.lang.String testName)-
-
-
- Instantiates a new HTTP utilities test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testAddCSRFToken
--public void testAddCSRFToken() - throws AuthenticationException-
-
-
- Test of addCSRFToken method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
-
- Throws: -
AuthenticationException
- -
-testChangeSessionIdentifier
--public void testChangeSessionIdentifier() - throws EnterpriseSecurityException-
-
-
- Test of sendRedirect method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
-
- Throws: -
ValidationException- the validation exception -java.io.IOException- Signals that an I/O exception has occurred. -AuthenticationException- the authentication exception -EnterpriseSecurityException
- -
-testGetFileUploads
--public void testGetFileUploads() - throws java.io.IOException-
-
-
- Test of formatHttpRequestForLog method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
-
- Throws: -
java.io.IOException
- -
-testIsValidHTTPRequest
--public void testIsValidHTTPRequest()-
-
-
- Test of isValidHTTPRequest method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
- -
-testKillAllCookies
--public void testKillAllCookies()-
-
-
- Test of killAllCookies method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
- -
-testKillCookie
--public void testKillCookie()-
-
-
- Test of killCookie method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
- -
-testSendSafeRedirect
--public void testSendSafeRedirect() - throws ValidationException, - java.io.IOException-
-
-
- Test of sendRedirect method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
-
- Throws: -
ValidationException- the validation exception -java.io.IOException- Signals that an I/O exception has occurred.
- -
-testSetCookie
--public void testSetCookie()-
-
-
- Test of setCookie method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
- -
-testGetStateFromEncryptedCookie
--public void testGetStateFromEncryptedCookie()-
-
-
-
-
-
- -
-testSaveStateInEncryptedCookie
--public void testSaveStateInEncryptedCookie()-
-
-
-
-
-
- -
-testSetNoCacheHeaders
--public void testSetNoCacheHeaders()-
-
-
- Test set no cache headers.
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/IntegrityException.html b/javadoc/org/owasp/esapi/IntegrityException.html deleted file mode 100644 index e5ff44b47..000000000 --- a/javadoc/org/owasp/esapi/IntegrityException.html +++ /dev/null @@ -1,278 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class IntegrityException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class IntegrityException
- extends EnterpriseSecurityException
-An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy. For example, if a database connection pool runs out - of connections, an availability exception should be thrown. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
IntegrityException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of IntegrityException. |
-|
IntegrityException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new IntegrityException. |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-IntegrityException
--public IntegrityException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of IntegrityException.
-
-
- -
-IntegrityException
--public IntegrityException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new IntegrityException.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/IntrusionDetector.html b/javadoc/org/owasp/esapi/IntrusionDetector.html deleted file mode 100644 index 525b3d328..000000000 --- a/javadoc/org/owasp/esapi/IntrusionDetector.html +++ /dev/null @@ -1,264 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface IntrusionDetector
--
-
- All Known Implementing Classes:
- DefaultIntrusionDetector -
-
-
-
- public interface IntrusionDetector
-The IntrusionDetector interface is intended to track security relevant events and identify attack behavior. The - implementation can use as much state as necessary to detect attacks, but note that storing too much state will burden - your system. -
- 
-
-
- The interface is currently designed to accept exceptions as well as custom events. Implementations can use this - stream of information to detect both normal and abnormal behavior. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- void |
-addEvent(java.lang.String eventName,
- java.lang.String logMessage)
-
-- Adds the event to the IntrusionDetector. |
-
- void |
-addException(java.lang.Exception exception)
-
-- Adds the exception to the IntrusionDetector. |
-
| -Method Detail | -
-addException
--public void addException(java.lang.Exception exception) - throws IntrusionException-
-
-
- Adds the exception to the IntrusionDetector.
-
-
-
-
- Parameters:
exception- the exception -- Throws: -
IntrusionException- the intrusion exception
- -
-addEvent
--public void addEvent(java.lang.String eventName, - java.lang.String logMessage) - throws IntrusionException-
-
-
- Adds the event to the IntrusionDetector.
-
-
-
-
- Parameters:
eventName- the eventlogMessage- the message to log with the event -- Throws: -
IntrusionException- the intrusion exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/IntrusionDetectorTest.html b/javadoc/org/owasp/esapi/IntrusionDetectorTest.html deleted file mode 100644 index ef04439d6..000000000 --- a/javadoc/org/owasp/esapi/IntrusionDetectorTest.html +++ /dev/null @@ -1,336 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class IntrusionDetectorTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class IntrusionDetectorTest
- extends junit.framework.TestCase
-The Class IntrusionDetectorTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
IntrusionDetectorTest(java.lang.String testName)
-
-- Instantiates a new intrusion detector test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testAddEvent()
-
-- Test of addEvent method, of class org.owasp.esapi.IntrusionDetector. |
-
- void |
-testAddException()
-
-- Test of addException method, of class org.owasp.esapi.IntrusionDetector. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-IntrusionDetectorTest
--public IntrusionDetectorTest(java.lang.String testName)-
-
-
- Instantiates a new intrusion detector test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testAddException
--public void testAddException() - throws AuthenticationException-
-
-
- Test of addException method, of class org.owasp.esapi.IntrusionDetector.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testAddEvent
--public void testAddEvent() - throws AuthenticationException-
-
-
- Test of addEvent method, of class org.owasp.esapi.IntrusionDetector.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/IntrusionException.html b/javadoc/org/owasp/esapi/IntrusionException.html deleted file mode 100644 index 55308f335..000000000 --- a/javadoc/org/owasp/esapi/IntrusionException.html +++ /dev/null @@ -1,341 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class IntrusionException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class IntrusionException
- extends java.lang.RuntimeException
-An IntrusionException should be thrown anytime an error condition arises that is likely to be the result of an attack - in progress. IntrusionExceptions are handled specially by the IntrusionDetector, which is equipped to respond by - either specially logging the event, logging out the current user, or invalidating the current user's account. -
- Unlike other exceptions in the ESAPI, the IntrusionException is a RuntimeException so that it can be thrown from - anywhere and will not require a lot of special exception handling. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
IntrusionException()
-
-- Internal classes may throw an IntrusionException to the IntrusionDetector, which generates the appropriate log - message. |
-|
IntrusionException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of IntrusionException. |
-|
IntrusionException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new intrusion exception. |
-|
| -Method Summary | -|
- java.lang.String |
-getLogMessage()
-
-- |
-
- java.lang.String |
-getUserMessage()
-
-- |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-IntrusionException
--public IntrusionException()-
-
-
- Internal classes may throw an IntrusionException to the IntrusionDetector, which generates the appropriate log
- message.
-
-
- -
-IntrusionException
--public IntrusionException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of IntrusionException.
-
-
- -
-IntrusionException
--public IntrusionException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new intrusion exception.
-
-
- Parameters:
cause- the cause
| -Method Detail | -
-getUserMessage
--public java.lang.String getUserMessage()-
-
-
-
-
-
- -
-getLogMessage
--public java.lang.String getLogMessage()-
-
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/JavaLogFactory.html b/javadoc/org/owasp/esapi/JavaLogFactory.html deleted file mode 100644 index 94d1921b5..000000000 --- a/javadoc/org/owasp/esapi/JavaLogFactory.html +++ /dev/null @@ -1,284 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class JavaLogFactory
--java.lang.Object --
-
-
- All Implemented Interfaces:
- ILogFactory -
-
-
-
- public class JavaLogFactory
- extends java.lang.Object
- implements ILogFactory
- extends java.lang.Object
-
-
-
- Author: -
- rdawes -
- -
| -Constructor Summary | -|
JavaLogFactory(java.lang.String applicationName)
-
-- |
-|
| -Method Summary | -|
- ILogger |
-getLogger(java.lang.Class clazz)
-
-- |
-
- ILogger |
-getLogger(java.lang.String name)
-
-- |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-JavaLogFactory
--public JavaLogFactory(java.lang.String applicationName)-
-
-
| -Method Detail | -
-getLogger
--public ILogger getLogger(java.lang.Class clazz)-
-
-
-
-
- Specified by:
getLoggerin interfaceILogFactory
--
-
-
- -
-getLogger
--public ILogger getLogger(java.lang.String name)-
-
-
-
-
- Specified by:
getLoggerin interfaceILogFactory
--
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/LogFactory.html b/javadoc/org/owasp/esapi/LogFactory.html deleted file mode 100644 index 4522af100..000000000 --- a/javadoc/org/owasp/esapi/LogFactory.html +++ /dev/null @@ -1,246 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface LogFactory
--
-
- All Known Implementing Classes:
- JavaLogFactory -
-
-
-
- public interface LogFactory
-The LogFactory interface is intended to allow substitution of various logging packages, while providing - a common interface to access them. - - In the default implementation, JavaLogFactory.java implements this interface. JavaLogFactory.java also contains an - inner class called JavaLogger which implements Logger.java and uses the Java logging package to log events. -
- -
-
-
-
- Author: -
- rdawes -
- See Also:
ESAPI
- -
| -Method Summary | -|
- Logger |
-getLogger(java.lang.Class clazz)
-
-- |
-
- Logger |
-getLogger(java.lang.String name)
-
-- |
-
| -Method Detail | -
-getLogger
--public Logger getLogger(java.lang.String name)-
-
-
-
-
-
- -
-getLogger
--public Logger getLogger(java.lang.Class clazz)-
-
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/Logger.html b/javadoc/org/owasp/esapi/Logger.html deleted file mode 100644 index 57db0bf83..000000000 --- a/javadoc/org/owasp/esapi/Logger.html +++ /dev/null @@ -1,738 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface Logger
--
-
-
- public interface Logger
-The Logger interface defines a set of methods that can be used to log - security events. Implementors should use a well established logging library - as it is quite difficult to create a high-performance logger. -
- 
-
- - The order of logging levels is: -
-
-
- trace -
- debug -
- info -
- warn -
- error -
- fatal (the most serious) -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Field Summary | -|
-static java.lang.String |
-FUNCTIONALITY
-
-- |
-
-static java.lang.String |
-PERFORMANCE
-
-- |
-
-static java.lang.String |
-SECURITY
-
-- |
-
-static java.lang.String |
-USABILITY
-
-- |
-
| -Method Summary | -|
- void |
-debug(java.lang.String type,
- java.lang.String message)
-
-- Log debug. |
-
- void |
-debug(java.lang.String type,
- java.lang.String message,
- java.lang.Throwable throwable)
-
-- Log debug. |
-
- void |
-error(java.lang.String type,
- java.lang.String message)
-
-- Log error. |
-
- void |
-error(java.lang.String type,
- java.lang.String message,
- java.lang.Throwable throwable)
-
-- Log error. |
-
- void |
-fatal(java.lang.String type,
- java.lang.String message)
-
-- Log critical. |
-
- void |
-fatal(java.lang.String type,
- java.lang.String message,
- java.lang.Throwable throwable)
-
-- Log critical. |
-
- void |
-info(java.lang.String type,
- java.lang.String message)
-
-- Log success. |
-
- void |
-info(java.lang.String type,
- java.lang.String message,
- java.lang.Throwable throwable)
-
-- Log success. |
-
- boolean |
-isDebugEnabled()
-
-- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing |
-
- boolean |
-isErrorEnabled()
-
-- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing |
-
- boolean |
-isFatalEnabled()
-
-- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing |
-
- boolean |
-isInfoEnabled()
-
-- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing |
-
- boolean |
-isTraceEnabled()
-
-- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing |
-
- boolean |
-isWarningEnabled()
-
-- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing |
-
- void |
-trace(java.lang.String type,
- java.lang.String message)
-
-- Log trace. |
-
- void |
-trace(java.lang.String type,
- java.lang.String message,
- java.lang.Throwable throwable)
-
-- Log trace. |
-
- void |
-warning(java.lang.String type,
- java.lang.String message)
-
-- Log warning. |
-
- void |
-warning(java.lang.String type,
- java.lang.String message,
- java.lang.Throwable throwable)
-
-- Log warning. |
-
| -Field Detail | -
-SECURITY
--public static final java.lang.String SECURITY-
-
-
- See Also:
- Constant Field Values
-
-
- -
-USABILITY
--public static final java.lang.String USABILITY-
-
-
- See Also:
- Constant Field Values
-
-
- -
-PERFORMANCE
--public static final java.lang.String PERFORMANCE-
-
-
- See Also:
- Constant Field Values
-
-
- -
-FUNCTIONALITY
--public static final java.lang.String FUNCTIONALITY-
-
-
- See Also:
- Constant Field Values
-
-
| -Method Detail | -
-fatal
--public void fatal(java.lang.String type, - java.lang.String message)-
-
-
- Log critical.
-
-
-
-
- Parameters:
type- the type of eventmessage- the message to log to log
- -
-fatal
--public void fatal(java.lang.String type, - java.lang.String message, - java.lang.Throwable throwable)-
-
-
- Log critical.
-
-
-
-
- Parameters:
type- the type of event of eventmessage- the message to log to logthrowable- the exception thrown
- -
-isFatalEnabled
--public boolean isFatalEnabled()-
-
-
- Allows the caller to determine if messages logged at this level
- will be discarded, to avoid performing expensive processing
-
-
-
-
-
- Returns:
- true if fatal messages will be output to the log
- -
-debug
--public void debug(java.lang.String type, - java.lang.String message)-
-
-
- Log debug.
-
-
-
-
- Parameters:
type- the type of eventmessage- the message to log
- -
-debug
--public void debug(java.lang.String type, - java.lang.String message, - java.lang.Throwable throwable)-
-
-
- Log debug.
-
-
-
-
- Parameters:
type- the type of eventmessage- the message to logthrowable- the exception thrown
- -
-isDebugEnabled
--public boolean isDebugEnabled()-
-
-
- Allows the caller to determine if messages logged at this level
- will be discarded, to avoid performing expensive processing
-
-
-
-
-
- Returns:
- true if debug messages will be output to the log
- -
-error
--public void error(java.lang.String type, - java.lang.String message)-
-
-
- Log error.
-
-
-
-
- Parameters:
type- the type of eventmessage- the message to log
- -
-error
--public void error(java.lang.String type, - java.lang.String message, - java.lang.Throwable throwable)-
-
-
- Log error.
-
-
-
-
- Parameters:
type- the type of eventmessage- the message to logthrowable- the exception thrown
- -
-isErrorEnabled
--public boolean isErrorEnabled()-
-
-
- Allows the caller to determine if messages logged at this level
- will be discarded, to avoid performing expensive processing
-
-
-
-
-
- Returns:
- true if error messages will be output to the log
- -
-info
--public void info(java.lang.String type, - java.lang.String message)-
-
-
- Log success.
-
-
-
-
- Parameters:
type- the type of eventmessage- the message to log
- -
-info
--public void info(java.lang.String type, - java.lang.String message, - java.lang.Throwable throwable)-
-
-
- Log success.
-
-
-
-
- Parameters:
type- the type of eventmessage- the message to logthrowable- the exception thrown
- -
-isInfoEnabled
--public boolean isInfoEnabled()-
-
-
- Allows the caller to determine if messages logged at this level
- will be discarded, to avoid performing expensive processing
-
-
-
-
-
- Returns:
- true info if messages will be output to the log
- -
-trace
--public void trace(java.lang.String type, - java.lang.String message)-
-
-
- Log trace.
-
-
-
-
- Parameters:
type- the type of eventmessage- the message to log
- -
-trace
--public void trace(java.lang.String type, - java.lang.String message, - java.lang.Throwable throwable)-
-
-
- Log trace.
-
-
-
-
- Parameters:
type- the type of eventmessage- the message to logthrowable- the exception thrown
- -
-isTraceEnabled
--public boolean isTraceEnabled()-
-
-
- Allows the caller to determine if messages logged at this level
- will be discarded, to avoid performing expensive processing
-
-
-
-
-
- Returns:
- true if trace messages will be output to the log
- -
-warning
--public void warning(java.lang.String type, - java.lang.String message)-
-
-
- Log warning.
-
-
-
-
- Parameters:
type- the type of eventmessage- the message to log
- -
-warning
--public void warning(java.lang.String type, - java.lang.String message, - java.lang.Throwable throwable)-
-
-
- Log warning.
-
-
-
-
- Parameters:
type- the type of eventmessage- the message to logthrowable- the exception thrown
- -
-isWarningEnabled
--public boolean isWarningEnabled()-
-
-
- Allows the caller to determine if messages logged at this level
- will be discarded, to avoid performing expensive processing
-
-
-
-
-
- Returns:
- true if warning messages will be output to the log
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/LoggerTest.html b/javadoc/org/owasp/esapi/LoggerTest.html deleted file mode 100644 index 0bd5fba05..000000000 --- a/javadoc/org/owasp/esapi/LoggerTest.html +++ /dev/null @@ -1,442 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class LoggerTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class LoggerTest
- extends junit.framework.TestCase
-The Class LoggerTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
LoggerTest(java.lang.String testName)
-
-- Instantiates a new logger test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testLogCritical()
-
-- Test of logCritical method, of class org.owasp.esapi.Logger. |
-
- void |
-testLogDebug()
-
-- Test of logDebug method, of class org.owasp.esapi.Logger. |
-
- void |
-testLogError()
-
-- Test of logError method, of class org.owasp.esapi.Logger. |
-
- void |
-testLogHTTPRequest()
-
-- Test of logHTTPRequest method, of class org.owasp.esapi.Logger. |
-
- void |
-testLogSuccess()
-
-- Test of logSuccess method, of class org.owasp.esapi.Logger. |
-
- void |
-testLogTrace()
-
-- Test of logTrace method, of class org.owasp.esapi.Logger. |
-
- void |
-testLogWarning()
-
-- Test of logWarning method, of class org.owasp.esapi.Logger. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-LoggerTest
--public LoggerTest(java.lang.String testName)-
-
-
- Instantiates a new logger test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testLogHTTPRequest
--public void testLogHTTPRequest() - throws ValidationException, - java.io.IOException, - AuthenticationException-
-
-
- Test of logHTTPRequest method, of class org.owasp.esapi.Logger.
-
-
-
-
-
- Throws: -
ValidationException- the validation exception -java.io.IOException- Signals that an I/O exception has occurred. -AuthenticationException- the authentication exception
- -
-testLogSuccess
--public void testLogSuccess()-
-
-
- Test of logSuccess method, of class org.owasp.esapi.Logger.
-
-
-
-
- -
-testLogTrace
--public void testLogTrace()-
-
-
- Test of logTrace method, of class org.owasp.esapi.Logger.
-
-
-
-
- -
-testLogDebug
--public void testLogDebug()-
-
-
- Test of logDebug method, of class org.owasp.esapi.Logger.
-
-
-
-
- -
-testLogError
--public void testLogError()-
-
-
- Test of logError method, of class org.owasp.esapi.Logger.
-
-
-
-
- -
-testLogWarning
--public void testLogWarning()-
-
-
- Test of logWarning method, of class org.owasp.esapi.Logger.
-
-
-
-
- -
-testLogCritical
--public void testLogCritical()-
-
-
- Test of logCritical method, of class org.owasp.esapi.Logger.
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/RandomAccessReferenceMap.html b/javadoc/org/owasp/esapi/RandomAccessReferenceMap.html deleted file mode 100644 index 416d8460d..000000000 --- a/javadoc/org/owasp/esapi/RandomAccessReferenceMap.html +++ /dev/null @@ -1,444 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class RandomAccessReferenceMap
--java.lang.Object --
-
-
- All Implemented Interfaces:
- AccessReferenceMap -
-
-
-
- public class RandomAccessReferenceMap
- extends java.lang.Object
- implements AccessReferenceMap
- extends java.lang.Object
-Reference implementation of the AccessReferenceMap interface. This - implementation generates random 6 character alphanumeric strings for indirect - references. It is possible to use simple integers as indirect references, but - the random string approach provides a certain level of protection from CSRF - attacks, because an attacker would have difficulty guessing the indirect - reference. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
AccessReferenceMap
- -
| -Constructor Summary | -|
RandomAccessReferenceMap()
-
-- This AccessReferenceMap implementation uses short random strings to - create a layer of indirection. |
-|
RandomAccessReferenceMap(java.util.Set directReferences)
-
-- Instantiates a new access reference map. |
-|
| -Method Summary | -|
- java.lang.String |
-addDirectReference(java.lang.Object direct)
-
-- Adds a direct reference and a new random indirect reference, overwriting any existing values. |
-
- java.lang.Object |
-getDirectReference(java.lang.String indirectReference)
-
-- Get the original direct object reference from an indirect reference. |
-
- java.lang.String |
-getIndirectReference(java.lang.Object directReference)
-
-- Get a safe indirect reference to use in place of a potentially sensitive - direct object reference. |
-
- java.util.Iterator |
-iterator()
-
-- Get an iterator through the direct object references. |
-
- java.lang.String |
-removeDirectReference(java.lang.Object direct)
-
-- Remove a direct reference and the corresponding indirect reference. |
-
- void |
-update(java.util.Set directReferences)
-
-- This preserves any existing mappings for items that are still in the new - list. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-RandomAccessReferenceMap
--public RandomAccessReferenceMap()-
-
-
- This AccessReferenceMap implementation uses short random strings to
- create a layer of indirection. Other possible implementations would use
- simple integers as indirect references.
-
-
- -
-RandomAccessReferenceMap
--public RandomAccessReferenceMap(java.util.Set directReferences)-
-
-
- Instantiates a new access reference map.
-
-
- Parameters:
directReferences- the direct references
| -Method Detail | -
-iterator
--public java.util.Iterator iterator()-
-
-
- Description copied from interface:
AccessReferenceMap
- - Get an iterator through the direct object references. No guarantee is made as
- to the order of items returned.
-
-
-
-
- Specified by:
iteratorin interfaceAccessReferenceMap
-
-
-
- Returns:
- the iterator
- -
-addDirectReference
--public java.lang.String addDirectReference(java.lang.Object direct)-
-
-
- Adds a direct reference and a new random indirect reference, overwriting any existing values.
-
-
-
-
- Specified by:
addDirectReferencein interfaceAccessReferenceMap
-
-
- Parameters:
direct- -- Returns:
- the corresponding indirect reference
- -
-removeDirectReference
--public java.lang.String removeDirectReference(java.lang.Object direct) - throws AccessControlException-
-
-
- Remove a direct reference and the corresponding indirect reference.
-
-
-
-
- Specified by:
removeDirectReferencein interfaceAccessReferenceMap
-
-
- Parameters:
direct- -- Returns:
- the corresponding indirect reference -
- Throws: -
AccessControlException- FIXME Why might we throw an ACE here?
- -
-update
--public final void update(java.util.Set directReferences)-
-
-
- This preserves any existing mappings for items that are still in the new
- list. You could regenerate new indirect references every time, but that
- might mess up anything that previously used an indirect reference, such
- as a URL parameter.
-
-
-
-
-
-
- Parameters:
directReferences- the direct references
- -
-getIndirectReference
--public java.lang.String getIndirectReference(java.lang.Object directReference)-
-
-
- Description copied from interface:
AccessReferenceMap
- - Get a safe indirect reference to use in place of a potentially sensitive
- direct object reference. Developers should use this call when building
- URL's, form fields, hidden fields, etc... to help protect their private
- implementation information.
-
-
-
-
- Specified by:
getIndirectReferencein interfaceAccessReferenceMap
-
-
- Parameters:
directReference- the direct reference -- Returns:
- the indirect reference
- -
-getDirectReference
--public java.lang.Object getDirectReference(java.lang.String indirectReference) - throws AccessControlException-
-
-
- Description copied from interface:
AccessReferenceMap
- - Get the original direct object reference from an indirect reference.
- Developers should use this when they get an indirect reference from a
- request to translate it back into the real direct reference. If an
- invalid indirectReference is requested, then an AccessControlException is
- thrown.
-
-
-
-
- Specified by:
getDirectReferencein interfaceAccessReferenceMap
-
-
- Parameters:
indirectReference- the indirect reference -- Returns:
- the direct reference -
- Throws: -
AccessControlException- if no direct reference exists for the - specified indirect reference
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/Randomizer.html b/javadoc/org/owasp/esapi/Randomizer.html deleted file mode 100644 index aac181cdd..000000000 --- a/javadoc/org/owasp/esapi/Randomizer.html +++ /dev/null @@ -1,377 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface Randomizer
--
-
- All Known Implementing Classes:
- DefaultRandomizer -
-
-
-
- public interface Randomizer
-The IRandomizer interface defines a set of methods for creating - cryptographically random numbers and strings. Implementers should be sure to - use a strong cryptographic implementation, such as the JCE or BouncyCastle. - Weak sources of randomness can undermine a wide variety of security - mechanisms. -
- 
-
-
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- boolean |
-getRandomBoolean()
-
-- Returns a random boolean. |
-
- java.lang.String |
-getRandomFilename(java.lang.String extension)
-
-- Returns an unguessable random filename with the specified extension. |
-
- java.lang.String |
-getRandomGUID()
-
-- Generates a random GUID. |
-
- int |
-getRandomInteger(int min,
- int max)
-
-- Gets the random integer. |
-
- long |
-getRandomLong()
-
-- Gets the random long. |
-
- float |
-getRandomReal(float min,
- float max)
-
-- Gets the random real. |
-
- java.lang.String |
-getRandomString(int length,
- char[] characterSet)
-
-- Gets a random string. |
-
| -Method Detail | -
-getRandomString
--public java.lang.String getRandomString(int length, - char[] characterSet)-
-
-
- Gets a random string. of a desired length and character set.
-
-
-
-
- Parameters:
length- the length of the stringcharacterSet- the character set -- Returns:
- the random string
- -
-getRandomBoolean
--public boolean getRandomBoolean()-
-
-
- Returns a random boolean.
-
-
-
-
-
- Returns:
- true or false, randomly
- -
-getRandomInteger
--public int getRandomInteger(int min, - int max)-
-
-
- Gets the random integer.
-
-
-
-
- Parameters:
min- the minimum integer that will be returnedmax- the maximum integer that will be returned -- Returns:
- the random integer
- -
-getRandomLong
--public long getRandomLong()-
-
-
- Gets the random long.
-
-
-
-
-
- Returns:
- the random long
- -
-getRandomFilename
--public java.lang.String getRandomFilename(java.lang.String extension)-
-
-
- Returns an unguessable random filename with the specified extension.
-
-
-
-
-
- Returns:
- a random unguessable filename ending with the specified extension
- -
-getRandomReal
--public float getRandomReal(float min, - float max)-
-
-
- Gets the random real.
-
-
-
-
- Parameters:
min- the minimum real number that will be returnedmax- the maximum real number that will be returned -- Returns:
- the random real
- -
-getRandomGUID
--public java.lang.String getRandomGUID() - throws EncryptionException-
-
-
- Generates a random GUID.
-
-
-
-
-
- Returns:
- the GUID -
- Throws: -
EncryptionException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/RandomizerTest.html b/javadoc/org/owasp/esapi/RandomizerTest.html deleted file mode 100644 index 6d0276bb8..000000000 --- a/javadoc/org/owasp/esapi/RandomizerTest.html +++ /dev/null @@ -1,375 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class RandomizerTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class RandomizerTest
- extends junit.framework.TestCase
-The Class RandomizerTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
RandomizerTest(java.lang.String testName)
-
-- Instantiates a new randomizer test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testGetRandomGUID()
-
-- Test of getRandomGUID method, of class org.owasp.esapi.Randomizer. |
-
- void |
-testGetRandomInteger()
-
-- Test of getRandomInteger method, of class org.owasp.esapi.Randomizer. |
-
- void |
-testGetRandomReal()
-
-- Test of getRandomReal method, of class org.owasp.esapi.Randomizer. |
-
- void |
-testGetRandomString()
-
-- Test of getRandomString method, of class org.owasp.esapi.Randomizer. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-RandomizerTest
--public RandomizerTest(java.lang.String testName)-
-
-
- Instantiates a new randomizer test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testGetRandomString
--public void testGetRandomString()-
-
-
- Test of getRandomString method, of class org.owasp.esapi.Randomizer.
-
-
-
-
- -
-testGetRandomInteger
--public void testGetRandomInteger()-
-
-
- Test of getRandomInteger method, of class org.owasp.esapi.Randomizer.
-
-
-
-
- -
-testGetRandomReal
--public void testGetRandomReal()-
-
-
- Test of getRandomReal method, of class org.owasp.esapi.Randomizer.
-
-
-
-
- -
-testGetRandomGUID
--public void testGetRandomGUID() - throws EncryptionException-
-
-
- Test of getRandomGUID method, of class org.owasp.esapi.Randomizer.
-
-
-
-
-
- Throws: -
EncryptionException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/SafeFile.html b/javadoc/org/owasp/esapi/SafeFile.html deleted file mode 100644 index ecc7ec3b2..000000000 --- a/javadoc/org/owasp/esapi/SafeFile.html +++ /dev/null @@ -1,308 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class SafeFile
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.lang.Comparable, java.io.Serializable -
-
-
-
- public class SafeFile
- extends java.io.File
-Extension to java.io.File to prevent against null byte injections and - other unforeseen problems resulting from unprintable characters - causing problems in path lookups. This does _not_ prevent against - directory traversal attacks. -
- -
-
-
-
- See Also:
- Serialized Form
- -
| -Field Summary | -
| Fields inherited from class java.io.File | -
pathSeparator, pathSeparatorChar, separator, separatorChar |
-
| -Constructor Summary | -|
SafeFile(java.io.File parent,
- java.lang.String child)
-
-- |
-|
SafeFile(java.lang.String path)
-
-- |
-|
SafeFile(java.lang.String parent,
- java.lang.String child)
-
-- |
-|
SafeFile(java.net.URI uri)
-
-- |
-|
| Methods inherited from class java.io.File | -
canRead, canWrite, compareTo, compareTo, createNewFile, createTempFile, createTempFile, delete, deleteOnExit, equals, exists, getAbsoluteFile, getAbsolutePath, getCanonicalFile, getCanonicalPath, getName, getParent, getParentFile, getPath, hashCode, isAbsolute, isDirectory, isFile, isHidden, lastModified, length, list, list, listFiles, listFiles, listFiles, listRoots, mkdir, mkdirs, renameTo, setLastModified, setReadOnly, toString, toURI, toURL |
-
| Methods inherited from class java.lang.Object | -
getClass, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-SafeFile
--public SafeFile(java.lang.String path) - throws ValidationException-
-
-
- -
-SafeFile
--public SafeFile(java.lang.String parent, - java.lang.String child) - throws ValidationException-
-
-
- -
-SafeFile
--public SafeFile(java.io.File parent, - java.lang.String child) - throws ValidationException-
-
-
- -
-SafeFile
--public SafeFile(java.net.URI uri) - throws ValidationException-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/SafeFileTest.html b/javadoc/org/owasp/esapi/SafeFileTest.html deleted file mode 100644 index 43a7b55ef..000000000 --- a/javadoc/org/owasp/esapi/SafeFileTest.html +++ /dev/null @@ -1,495 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class SafeFileTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class SafeFileTest
- extends junit.framework.TestCase
-The Class ExecutorTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
SafeFileTest(java.lang.String testName)
-
-- Instantiates a new executor test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testAlternateDataStream()
-
-- |
-
- void |
-testCreateSafeFile()
-
-- Test of executeOSCommand method, of class org.owasp.esapi.Executor |
-
- void |
-testCreateSafeFileParentConstructor()
-
-- |
-
- void |
-testCreateSafeFileURIConstructor()
-
-- |
-
- void |
-testJavaDirInjection()
-
-- |
-
- void |
-testJavaFileInjection()
-
-- |
-
- void |
-testMultipleJavaFileInjection()
-
-- |
-
- void |
-testNormalPercentEncodedFileInjection()
-
-- |
-
- void |
-testWeirdPercentEncodedFileInjection()
-
-- |
-
-static java.lang.String |
-toHex(byte b)
-
-- |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-SafeFileTest
--public SafeFileTest(java.lang.String testName)-
-
-
- Instantiates a new executor test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testJavaFileInjection
--public void testJavaFileInjection()-
-
-
-
-
-
- -
-testMultipleJavaFileInjection
--public void testMultipleJavaFileInjection()-
-
-
-
-
-
- -
-testAlternateDataStream
--public void testAlternateDataStream()-
-
-
-
-
-
- -
-testJavaDirInjection
--public void testJavaDirInjection()-
-
-
-
-
-
- -
-toHex
--public static java.lang.String toHex(byte b)-
-
-
-
-
-
- -
-testNormalPercentEncodedFileInjection
--public void testNormalPercentEncodedFileInjection() - throws java.lang.Exception-
-
-
-
-
-
- Throws: -
java.lang.Exception
-
- -
-testWeirdPercentEncodedFileInjection
--public void testWeirdPercentEncodedFileInjection() - throws java.lang.Exception-
-
-
-
-
-
- Throws: -
java.lang.Exception
-
- -
-testCreateSafeFile
--public void testCreateSafeFile() - throws java.lang.Exception-
-
-
- Test of executeOSCommand method, of class org.owasp.esapi.Executor
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testCreateSafeFileParentConstructor
--public void testCreateSafeFileParentConstructor() - throws java.lang.Exception-
-
-
-
-
-
- Throws: -
java.lang.Exception
-
- -
-testCreateSafeFileURIConstructor
--public void testCreateSafeFileURIConstructor() - throws java.lang.Exception-
-
-
-
-
-
- Throws: -
java.lang.Exception
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/SecurityConfiguration.Threshold.html b/javadoc/org/owasp/esapi/SecurityConfiguration.Threshold.html deleted file mode 100644 index 536508ca7..000000000 --- a/javadoc/org/owasp/esapi/SecurityConfiguration.Threshold.html +++ /dev/null @@ -1,318 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class SecurityConfiguration.Threshold
--java.lang.Object --
-
-
- Enclosing class:
- SecurityConfiguration -
-
-
-
- public static class SecurityConfiguration.Threshold
- extends java.lang.Object
-Models a simple threshold as a count and an interval, along with a set of actions to take if the threshold is exceeded. -
- -
-
- -
| -Field Summary | -|
- java.util.List |
-actions
-
-- |
-
- int |
-count
-
-- |
-
- long |
-interval
-
-- |
-
- java.lang.String |
-name
-
-- |
-
| -Constructor Summary | -|
SecurityConfiguration.Threshold(java.lang.String name,
- int count,
- long interval,
- java.util.List actions)
-
-- |
-|
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Field Detail | -
-name
--public java.lang.String name-
-
-
-
-
- -
-count
--public int count-
-
-
-
-
- -
-interval
--public long interval-
-
-
-
-
- -
-actions
--public java.util.List actions-
-
-
-
-
| -Constructor Detail | -
-SecurityConfiguration.Threshold
--public SecurityConfiguration.Threshold(java.lang.String name, - int count, - long interval, - java.util.List actions)-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/SecurityConfiguration.html b/javadoc/org/owasp/esapi/SecurityConfiguration.html deleted file mode 100644 index fdd8f3302..000000000 --- a/javadoc/org/owasp/esapi/SecurityConfiguration.html +++ /dev/null @@ -1,691 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface SecurityConfiguration
--
-
- All Known Implementing Classes:
- DefaultSecurityConfiguration -
-
-
-
- public interface SecurityConfiguration
-The ISecurityConfiguration interface stores all configuration information - that directs the behavior of the ESAPI implementation. -
- 
-
- Protection of this configuration information is critical to the secure - operation of the application using the ESAPI. You should use operating system - access controls to limit access to wherever the configuration information is - stored. Please note that adding another layer of encryption does not make the - attackers job much more difficult. Somewhere there must be a master "secret" - that is stored unencrypted on the application platform. Creating another - layer of indirection doesn't provide any real additional security. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Nested Class Summary | -|
-static class |
-SecurityConfiguration.Threshold
-
-- Models a simple threshold as a count and an interval, along with a set of actions to take if the threshold is exceeded. |
-
| -Method Summary | -|
- java.util.List |
-getAllowedFileExtensions()
-
-- Gets the allowed file extensions. |
-
- int |
-getAllowedFileUploadSize()
-
-- Gets the allowed file upload size. |
-
- int |
-getAllowedLoginAttempts()
-
-- Gets the allowed login attempts. |
-
- java.lang.String |
-getApplicationName()
-
-- Gets the application name, used for logging |
-
- java.lang.String |
-getCharacterEncoding()
-
-- Gets the character encoding. |
-
- java.lang.String |
-getDigitalSignatureAlgorithm()
-
-- Gets the digital signature algorithm. |
-
- java.lang.String |
-getEncryptionAlgorithm()
-
-- Gets the encryption algorithm. |
-
- java.lang.String |
-getHashAlgorithm()
-
-- Gets the hashing algorithm. |
-
- java.io.File |
-getKeystore()
-
-- Gets the keystore. |
-
- boolean |
-getLogEncodingRequired()
-
-- Returns whether HTML entity encoding should be applied to log entries. |
-
- char[] |
-getMasterPassword()
-
-- Gets the master password. |
-
- byte[] |
-getMasterSalt()
-
-- Gets the master salt. |
-
- int |
-getMaxOldPasswordHashes()
-
-- Gets the max old password hashes. |
-
- java.lang.String |
-getPasswordParameterName()
-
-- Gets the password parameter name. |
-
- SecurityConfiguration.Threshold |
-getQuota(java.lang.String eventName)
-
-- Gets an intrusion detection Quota. |
-
- java.lang.String |
-getRandomAlgorithm()
-
-- Gets the random number generation algorithm. |
-
- long |
-getRememberTokenDuration()
-
-- Gets the time window allowed for the remember token in milliseconds. |
-
- java.lang.String |
-getResourceDirectory()
-
-- Gets the ESAPI resource directory as a String. |
-
- java.lang.String |
-getResponseContentType()
-
-- Gets the content-type set for responses. |
-
- java.lang.String |
-getUsernameParameterName()
-
-- Gets the username parameter name. |
-
- void |
-setResourceDirectory(java.lang.String dir)
-
-- Sets the ESAPI resource directory. |
-
| -Method Detail | -
-getApplicationName
--public java.lang.String getApplicationName()-
-
-
- Gets the application name, used for logging
-
-
-
-
-
- Returns:
- the application name
- -
-getMasterPassword
--public char[] getMasterPassword()-
-
-
- Gets the master password.
-
-
-
-
-
- Returns:
- the master password
- -
-getKeystore
--public java.io.File getKeystore()-
-
-
- Gets the keystore.
-
-
-
-
-
- Returns:
- the keystore
- -
-getMasterSalt
--public byte[] getMasterSalt()-
-
-
- Gets the master salt.
-
-
-
-
-
- Returns:
- the master salt
- -
-getAllowedFileExtensions
--public java.util.List getAllowedFileExtensions()-
-
-
- Gets the allowed file extensions.
-
-
-
-
-
- Returns:
- the allowed file extensions
- -
-getAllowedFileUploadSize
--public int getAllowedFileUploadSize()-
-
-
- Gets the allowed file upload size.
-
-
-
-
-
- Returns:
- the allowed file upload size
- -
-getPasswordParameterName
--public java.lang.String getPasswordParameterName()-
-
-
- Gets the password parameter name.
-
-
-
-
-
- Returns:
- the password parameter name
- -
-getUsernameParameterName
--public java.lang.String getUsernameParameterName()-
-
-
- Gets the username parameter name.
-
-
-
-
-
- Returns:
- the username parameter name
- -
-getEncryptionAlgorithm
--public java.lang.String getEncryptionAlgorithm()-
-
-
- Gets the encryption algorithm.
-
-
-
-
-
- Returns:
- the encryption algorithm
- -
-getHashAlgorithm
--public java.lang.String getHashAlgorithm()-
-
-
- Gets the hashing algorithm.
-
-
-
-
-
- Returns:
- the hashing algorithm
- -
-getCharacterEncoding
--public java.lang.String getCharacterEncoding()-
-
-
- Gets the character encoding.
-
-
-
-
-
- Returns:
- encoding character name
- -
-getDigitalSignatureAlgorithm
--public java.lang.String getDigitalSignatureAlgorithm()-
-
-
- Gets the digital signature algorithm.
-
-
-
-
-
- Returns:
- the digital signature algorithm
- -
-getRandomAlgorithm
--public java.lang.String getRandomAlgorithm()-
-
-
- Gets the random number generation algorithm.
-
-
-
-
-
- Returns:
- random number generation algorithm
- -
-getAllowedLoginAttempts
--public int getAllowedLoginAttempts()-
-
-
- Gets the allowed login attempts.
-
-
-
-
-
- Returns:
- the allowed login attempts
- -
-getMaxOldPasswordHashes
--public int getMaxOldPasswordHashes()-
-
-
- Gets the max old password hashes.
-
-
-
-
-
- Returns:
- the max old password hashes
- -
-getQuota
--public SecurityConfiguration.Threshold getQuota(java.lang.String eventName)-
-
-
- Gets an intrusion detection Quota.
-
-
-
-
- Parameters:
eventName- the event whose quota is desired -- Returns:
- the matching Quota for eventName
- -
-getResourceDirectory
--public java.lang.String getResourceDirectory()-
-
-
- Gets the ESAPI resource directory as a String.
-
-
-
-
-
- Returns:
- the ESAPI resource directory
- -
-setResourceDirectory
--public void setResourceDirectory(java.lang.String dir)-
-
-
- Sets the ESAPI resource directory.
-
-
-
-
- Parameters:
dir- location of the resource directory
- -
-getResponseContentType
--public java.lang.String getResponseContentType()-
-
-
- Gets the content-type set for responses.
-
-
-
-
- -
-getRememberTokenDuration
--public long getRememberTokenDuration()-
-
-
- Gets the time window allowed for the remember token in milliseconds.
-
-
-
-
- -
-getLogEncodingRequired
--public boolean getLogEncodingRequired()-
-
-
- Returns whether HTML entity encoding should be applied to log entries.
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/StringUtilities.html b/javadoc/org/owasp/esapi/StringUtilities.html deleted file mode 100644 index 4400cc26c..000000000 --- a/javadoc/org/owasp/esapi/StringUtilities.html +++ /dev/null @@ -1,315 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class StringUtilities
--java.lang.Object --
-
-
-
- public class StringUtilities
- extends java.lang.Object
-String utilities used in various filters. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Constructor Summary | -|
StringUtilities()
-
-- |
-|
| -Method Summary | -|
-static boolean |
-contains(java.lang.StringBuffer haystack,
- char c)
-
-- Returns true if the character is contained in the provided StringBuffer. |
-
-static java.lang.String |
-stripControls(java.lang.String input)
-
-- Removes all unprintable characters from a string - and replaces with a space for use in an HTTP header |
-
-static char[] |
-union(char[] c1,
- char[] c2)
-
-- Union two character arrays. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-StringUtilities
--public StringUtilities()-
-
-
| -Method Detail | -
-stripControls
--public static java.lang.String stripControls(java.lang.String input)-
-
-
- Removes all unprintable characters from a string
- and replaces with a space for use in an HTTP header
-
-
-
-
- Parameters:
input- -- Returns:
- the stripped header
- -
-union
--public static char[] union(char[] c1, - char[] c2)-
-
-
- Union two character arrays.
-
-
-
-
- Parameters:
c1- the c1c2- the c2 -- Returns:
- the char[]
- -
-contains
--public static boolean contains(java.lang.StringBuffer haystack, - char c)-
-
-
- Returns true if the character is contained in the provided StringBuffer.
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/Threshold.html b/javadoc/org/owasp/esapi/Threshold.html deleted file mode 100644 index e3eff7980..000000000 --- a/javadoc/org/owasp/esapi/Threshold.html +++ /dev/null @@ -1,322 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class Threshold
--java.lang.Object --
-
-
-
- public class Threshold
- extends java.lang.Object
-The threshold class simply models the data for a basic threshold with a name, - elapsed time, counter, and a set of actions to take. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) Aspect Security -
- -
| -Field Summary | -|
- java.util.List |
-actions
-
-- |
-
- int |
-count
-
-- |
-
- long |
-interval
-
-- |
-
- java.lang.String |
-name
-
-- |
-
| -Constructor Summary | -|
Threshold(java.lang.String name,
- int count,
- long interval,
- java.util.List actions)
-
-- |
-|
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Field Detail | -
-name
--public java.lang.String name-
-
-
-
-
- -
-count
--public int count-
-
-
-
-
- -
-interval
--public long interval-
-
-
-
-
- -
-actions
--public java.util.List actions-
-
-
-
-
| -Constructor Detail | -
-Threshold
--public Threshold(java.lang.String name, - int count, - long interval, - java.util.List actions)-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/User.html b/javadoc/org/owasp/esapi/User.html deleted file mode 100644 index 930d42360..000000000 --- a/javadoc/org/owasp/esapi/User.html +++ /dev/null @@ -1,1295 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface User
--
-
- All Superinterfaces:
- java.security.Principal -
-
-
- All Known Implementing Classes:
- DefaultUser -
-
-
-
- public interface User
- extends java.security.Principal
-The User interface represents an application user or user account. There is quite a lot of information that an - application must store for each user in order to enforce security properly. There are also many rules that govern - authentication and identity management. -
-
-
- A user account can be in one of several states. When first created, a User should be disabled, not expired, and - unlocked. To start using the account, an administrator should enable the account. The account can be locked for a - number of reasons, most commonly because they have failed login for too many times. Finally, the account can expire - after the expiration date has been reached. The User must be enabled, not expired, and unlocked in order to pass - authentication. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams at Aspect Security -
- -
| -Field Summary | -|
-static User |
-ANONYMOUS
-
-- The ANONYMOUS user is used to represent an unidentified user. |
-
| -Method Summary | -|
- void |
-addRole(java.lang.String role)
-
-- Adds a role to an account. |
-
- void |
-addRoles(java.util.Set newRoles)
-
-- Adds a set of roles to an account. |
-
- void |
-changePassword(java.lang.String oldPassword,
- java.lang.String newPassword1,
- java.lang.String newPassword2)
-
-- Sets the user's password, performing a verification of the user's old password, the equality of the two new - passwords, and the strength of the new password. |
-
- void |
-disable()
-
-- Disable account. |
-
- void |
-enable()
-
-- Enable account. |
-
- long |
-getAccountId()
-
-- Gets the account id. |
-
- java.lang.String |
-getAccountName()
-
-- Gets the account name. |
-
- java.lang.String |
-getCSRFToken()
-
-- Gets the CSRF token. |
-
- java.util.Date |
-getExpirationTime()
-
-- Returns the date that the current user's account will expire, usually when the account will be disabled. |
-
- int |
-getFailedLoginCount()
-
-- Returns the number of failed login attempts since the last successful login for an account. |
-
- java.util.Date |
-getLastFailedLoginTime()
-
-- Returns the date of the last failed login time for a user. |
-
- java.lang.String |
-getLastHostAddress()
-
-- Returns the last host address used by the user. |
-
- java.util.Date |
-getLastLoginTime()
-
-- Returns the date of the last successful login time for a user. |
-
- java.util.Date |
-getLastPasswordChangeTime()
-
-- Gets the date of user's last password change. |
-
- java.util.Set |
-getRoles()
-
-- Gets the roles assigned to a particular account. |
-
- java.lang.String |
-getScreenName()
-
-- Gets the screen name. |
-
- void |
-incrementFailedLoginCount()
-
-- Increment failed login count. |
-
- boolean |
-isAnonymous()
-
-- Checks if user is anonymous. |
-
- boolean |
-isEnabled()
-
-- Checks if an account is currently enabled. |
-
- boolean |
-isExpired()
-
-- Checks if an account is expired. |
-
- boolean |
-isInRole(java.lang.String role)
-
-- Checks if an account has been assigned a particular role. |
-
- boolean |
-isLocked()
-
-- Checks if an account is locked. |
-
- boolean |
-isLoggedIn()
-
-- Tests to see if the user is currently logged in. |
-
- boolean |
-isSessionAbsoluteTimeout()
-
-- Tests to see if the user's session has exceeded the absolute time out. |
-
- boolean |
-isSessionTimeout()
-
-- Tests to see if the user's session has timed out from inactivity. |
-
- void |
-lock()
-
-- Lock the user's account. |
-
- void |
-loginWithPassword(java.lang.String password)
-
-- Login with password. |
-
- void |
-logout()
-
-- Logout this user. |
-
- void |
-removeRole(java.lang.String role)
-
-- Removes a role from an account. |
-
- java.lang.String |
-resetCSRFToken()
-
-- Returns a token to be used as a prevention against CSRF attacks. |
-
- void |
-setAccountName(java.lang.String accountName)
-
-- Sets the account name. |
-
- void |
-setExpirationTime(java.util.Date expirationTime)
-
-- Sets the time when this user's account will expire. |
-
- void |
-setLastFailedLoginTime(java.util.Date lastFailedLoginTime)
-
-- Set the time of the last failed login for this user. |
-
- void |
-setLastHostAddress(java.lang.String remoteHost)
-
-- Set the last remote host address used by this user. |
-
- void |
-setLastLoginTime(java.util.Date lastLoginTime)
-
-- Set the time of the last successful login for this user. |
-
- void |
-setLastPasswordChangeTime(java.util.Date lastPasswordChangeTime)
-
-- Set the time of the last password change for this user. |
-
- void |
-setRoles(java.util.Set roles)
-
-- Sets the roles of this account. |
-
- void |
-setScreenName(java.lang.String screenName)
-
-- Sets the screen name. |
-
- void |
-unlock()
-
-- Unlock account. |
-
- boolean |
-verifyPassword(java.lang.String password)
-
-- Verify that the supplied password matches the password for this user. |
-
| Methods inherited from interface java.security.Principal | -
equals, getName, hashCode, toString |
-
| -Field Detail | -
-ANONYMOUS
--public static final User ANONYMOUS-
-
-
- The ANONYMOUS user is used to represent an unidentified user. Since there is
- always a real user, the ANONYMOUS user is better than using null to represent
- this.
-
-
-
-
| -Method Detail | -
-addRole
--public void addRole(java.lang.String role) - throws AuthenticationException-
-
-
- Adds a role to an account.
-
-
-
-
-
-
- Parameters:
role- the role to add -- Throws: -
AuthenticationException- the authentication exception
- -
-addRoles
--public void addRoles(java.util.Set newRoles) - throws AuthenticationException-
-
-
- Adds a set of roles to an account.
-
-
-
-
-
-
- Parameters:
newRoles- the new roles to add -- Throws: -
AuthenticationException- the authentication exception
- -
-changePassword
--public void changePassword(java.lang.String oldPassword, - java.lang.String newPassword1, - java.lang.String newPassword2) - throws AuthenticationException, - EncryptionException-
-
-
- Sets the user's password, performing a verification of the user's old password, the equality of the two new
- passwords, and the strength of the new password.
-
-
-
-
-
-
- Parameters:
oldPassword- the old passwordnewPassword1- the new passwordnewPassword2- the new password - used to verify that the new password was typed correctly -- Throws: -
AuthenticationException- if newPassword1 does not match newPassword2, if oldPassword does not match the stored old password, or if the new password does not meet complexity requirements -EncryptionException
- -
-disable
--public void disable()-
-
-
- Disable account.
-
-
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-enable
--public void enable()-
-
-
- Enable account.
-
-
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-getAccountId
--public long getAccountId()-
-
-
- Gets the account id.
-
-
-
-
-
-
-
- Returns:
- the account id
- -
-getAccountName
--public java.lang.String getAccountName()-
-
-
- Gets the account name.
-
-
-
-
-
-
-
- Returns:
- the account name
- -
-getCSRFToken
--public java.lang.String getCSRFToken()-
-
-
- Gets the CSRF token.
-
-
-
-
-
-
-
- Returns:
- the CSRF token
- -
-getExpirationTime
--public java.util.Date getExpirationTime()-
-
-
- Returns the date that the current user's account will expire, usually when the account will be disabled.
-
-
-
-
-
-
-
- Returns:
- Date representing the account expiration time.
- -
-getFailedLoginCount
--public int getFailedLoginCount()-
-
-
- Returns the number of failed login attempts since the last successful login for an account. This method is
- intended to be used as a part of the account lockout feature, to help protect against brute force attacks.
- However, the implementor should be aware that lockouts can be used to prevent access to an application by a
- legitimate user, and should consider the risk of denial of service.
-
-
-
-
-
-
-
- Returns:
- the number of failed login attempts since the last successful login
- -
-getLastHostAddress
--public java.lang.String getLastHostAddress()-
-
-
- Returns the last host address used by the user. This will be used in any log messages generated by the processing
- of this request.
-
-
-
-
-
-
-
- Returns:
- the last host address used by the user
- -
-getLastFailedLoginTime
--public java.util.Date getLastFailedLoginTime() - throws AuthenticationException-
-
-
- Returns the date of the last failed login time for a user. This date should be used in a message to users after a
- successful login, to notify them of potential attack activity on their account.
-
-
-
-
-
-
-
- Returns:
- date of the last failed login -
- Throws: -
AuthenticationException- the authentication exception
- -
-getLastLoginTime
--public java.util.Date getLastLoginTime()-
-
-
- Returns the date of the last successful login time for a user. This date should be used in a message to users
- after a successful login, to notify them of potential attack activity on their account.
-
-
-
-
-
-
-
- Returns:
- date of the last successful login
- -
-getLastPasswordChangeTime
--public java.util.Date getLastPasswordChangeTime()-
-
-
- Gets the date of user's last password change.
-
-
-
-
-
-
-
- Returns:
- the date of last password change
- -
-getRoles
--public java.util.Set getRoles()-
-
-
- Gets the roles assigned to a particular account.
-
-
-
-
-
-
-
- Returns:
- an immutable set of roles
- -
-getScreenName
--public java.lang.String getScreenName()-
-
-
- Gets the screen name.
-
-
-
-
-
-
-
- Returns:
- the screen name
- -
-incrementFailedLoginCount
--public void incrementFailedLoginCount()-
-
-
- Increment failed login count.
-
-
-
-
-
-
- -
-isAnonymous
--public boolean isAnonymous()-
-
-
- Checks if user is anonymous.
-
-
-
-
-
-
-
- Returns:
- true, if user is anonymous
- -
-isEnabled
--public boolean isEnabled()-
-
-
- Checks if an account is currently enabled.
-
-
-
-
-
-
-
- Returns:
- true, if account is enabled
- -
-isExpired
--public boolean isExpired()-
-
-
- Checks if an account is expired.
-
-
-
-
-
-
-
- Returns:
- true, if account is expired
- -
-isInRole
--public boolean isInRole(java.lang.String role)-
-
-
- Checks if an account has been assigned a particular role.
-
-
-
-
-
-
- Parameters:
role- the role for which to check -- Returns:
- true, if role has been assigned to user
- -
-isLocked
--public boolean isLocked()-
-
-
- Checks if an account is locked.
-
-
-
-
-
-
-
- Returns:
- true, if account is locked
- -
-isLoggedIn
--public boolean isLoggedIn()-
-
-
- Tests to see if the user is currently logged in.
-
-
-
-
-
-
-
- Returns:
- true, if the user is logged in
- -
-isSessionAbsoluteTimeout
--public boolean isSessionAbsoluteTimeout()-
-
-
- Tests to see if the user's session has exceeded the absolute time out.
-
-
-
-
-
-
-
- Returns:
- true, if user's session has exceeded the absolute time out
- -
-isSessionTimeout
--public boolean isSessionTimeout()-
-
-
- Tests to see if the user's session has timed out from inactivity.
-
-
-
-
-
-
-
- Returns:
- true, if user's session has timed out from inactivity
- -
-lock
--public void lock()-
-
-
- Lock the user's account.
-
-
-
-
-
-
- -
-loginWithPassword
--public void loginWithPassword(java.lang.String password) - throws AuthenticationException-
-
-
- Login with password.
-
-
-
-
-
-
- Parameters:
password- the password -- Throws: -
AuthenticationException- if login fails
- -
-logout
--public void logout()-
-
-
- Logout this user.
-
-
-
-
-
-
- -
-removeRole
--public void removeRole(java.lang.String role) - throws AuthenticationException-
-
-
- Removes a role from an account.
-
-
-
-
-
-
- Parameters:
role- the role to remove -- Throws: -
AuthenticationException- the authentication exception
- -
-resetCSRFToken
--public java.lang.String resetCSRFToken() - throws AuthenticationException-
-
-
- Returns a token to be used as a prevention against CSRF attacks. This token should be added to all links and
- forms. The application should verify that all requests contain the token, or they may have been generated by a
- CSRF attack. It is generally best to perform the check in a centralized location, either a filter or controller.
- See the verifyCSRFToken method.
-
-
-
-
-
-
-
- Returns:
- the new CSRF token -
- Throws: -
AuthenticationException- the authentication exception
- -
-setAccountName
--public void setAccountName(java.lang.String accountName)-
-
-
- Sets the account name.
-
-
-
-
-
-
- Parameters:
accountName- the new account name
- -
-setExpirationTime
--public void setExpirationTime(java.util.Date expirationTime)-
-
-
- Sets the time when this user's account will expire.
-
-
-
-
-
-
- Parameters:
expirationTime- the new expiration time
- -
-setRoles
--public void setRoles(java.util.Set roles) - throws AuthenticationException-
-
-
- Sets the roles of this account.
-
-
-
-
-
-
- Parameters:
roles- the new roles -- Throws: -
AuthenticationException- the authentication exception
- -
-setScreenName
--public void setScreenName(java.lang.String screenName)-
-
-
- Sets the screen name.
-
-
-
-
-
-
- Parameters:
screenName- the new screen name
- -
-unlock
--public void unlock()-
-
-
- Unlock account.
-
-
-
-
-
-
- -
-verifyPassword
--public boolean verifyPassword(java.lang.String password) - throws EncryptionException-
-
-
- Verify that the supplied password matches the password for this user. This method
- is typically used for "reauthentication" for the most sensitive functions, such
- as transactions, changing email address, and changing other account information.
-
-
-
-
-
-
- Parameters:
password- the password that the user entered -- Returns:
- true, if the password passed in matches the account's password -
- Throws: -
EncryptionException
- -
-setLastFailedLoginTime
--public void setLastFailedLoginTime(java.util.Date lastFailedLoginTime)-
-
-
- Set the time of the last failed login for this user.
-
-
-
-
-
-
- Parameters:
lastFailedLoginTime-
- -
-setLastHostAddress
--public void setLastHostAddress(java.lang.String remoteHost)-
-
-
- Set the last remote host address used by this user.
-
-
-
-
-
-
- Parameters:
remoteHost-
- -
-setLastLoginTime
--public void setLastLoginTime(java.util.Date lastLoginTime)-
-
-
- Set the time of the last successful login for this user.
-
-
-
-
-
-
- Parameters:
lastLoginTime-
- -
-setLastPasswordChangeTime
--public void setLastPasswordChangeTime(java.util.Date lastPasswordChangeTime)-
-
-
- Set the time of the last password change for this user.
-
-
-
-
-
-
- Parameters:
lastPasswordChangeTime-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/UserTest.html b/javadoc/org/owasp/esapi/UserTest.html deleted file mode 100644 index 72ce0caf3..000000000 --- a/javadoc/org/owasp/esapi/UserTest.html +++ /dev/null @@ -1,1040 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class UserTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class UserTest
- extends junit.framework.TestCase
-The Class UserTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
UserTest(java.lang.String testName)
-
-- Instantiates a new user test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testAddRole()
-
-- Test of testAddRole method, of class org.owasp.esapi.User. |
-
- void |
-testAddRoles()
-
-- Test of addRoles method, of class org.owasp.esapi.User. |
-
- void |
-testChangePassword()
-
-- Test of changePassword method, of class org.owasp.esapi.User. |
-
- void |
-testDisable()
-
-- Test of disable method, of class org.owasp.esapi.User. |
-
- void |
-testEnable()
-
-- Test of enable method, of class org.owasp.esapi.User. |
-
- void |
-testEquals()
-
-- Test equals. |
-
- void |
-testFailedLoginLockout()
-
-- Test of failedLoginCount lockout, of class org.owasp.esapi.User. |
-
- void |
-testGetAccountName()
-
-- Test of getAccountName method, of class org.owasp.esapi.User. |
-
- void |
-testGetLastFailedLoginTime()
-
-- Test get last failed login time. |
-
- void |
-testGetLastLoginTime()
-
-- Test get last login time. |
-
- void |
-testGetLastPasswordChangeTime()
-
-- Test of getLastPasswordChangeTime method, of class org.owasp.esapi.User. |
-
- void |
-testGetRoles()
-
-- Test of getRoles method, of class org.owasp.esapi.User. |
-
- void |
-testGetScreenName()
-
-- Test of xxx method, of class org.owasp.esapi.User. |
-
- void |
-testIncrementFailedLoginCount()
-
-- Test of incrementFailedLoginCount method, of class org.owasp.esapi.User. |
-
- void |
-testIsEnabled()
-
-- Test of isEnabled method, of class org.owasp.esapi.User. |
-
- void |
-testIsInRole()
-
-- Test of isInRole method, of class org.owasp.esapi.User. |
-
- void |
-testIsLocked()
-
-- Test of xxx method, of class org.owasp.esapi.User. |
-
- void |
-testIsSessionAbsoluteTimeout()
-
-- Test of isSessionAbsoluteTimeout method, of class - org.owasp.esapi.IntrusionDetector. |
-
- void |
-testIsSessionTimeout()
-
-- Test of isSessionTimeout method, of class - org.owasp.esapi.IntrusionDetector. |
-
- void |
-testLock()
-
-- Test of lockAccount method, of class org.owasp.esapi.User. |
-
- void |
-testLoginWithPassword()
-
-- Test of loginWithPassword method, of class org.owasp.esapi.User. |
-
- void |
-testLogout()
-
-- Test of logout method, of class org.owasp.esapi.User. |
-
- void |
-testRemoveRole()
-
-- Test of testRemoveRole method, of class org.owasp.esapi.User. |
-
- void |
-testResetCSRFToken()
-
-- Test of testResetCSRFToken method, of class org.owasp.esapi.User. |
-
- void |
-testResetPassword()
-
-- Test reset password. |
-
- void |
-testResetRememberToken()
-
-- Test of generateRememberMeToken method, of class org.owasp.esapi.User. |
-
- void |
-testSetAccountName()
-
-- Test of setAccountName method, of class org.owasp.esapi.User. |
-
- void |
-testSetExpirationTime()
-
-- Test of setExpirationTime method, of class org.owasp.esapi.User. |
-
- void |
-testSetRoles()
-
-- Test of setRoles method, of class org.owasp.esapi.User. |
-
- void |
-testSetScreenName()
-
-- Test of setScreenName method, of class org.owasp.esapi.User. |
-
- void |
-testUnlock()
-
-- Test of unlockAccount method, of class org.owasp.esapi.User. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-UserTest
--public UserTest(java.lang.String testName)-
-
-
- Instantiates a new user test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testAddRole
--public void testAddRole() - throws java.lang.Exception-
-
-
- Test of testAddRole method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testAddRoles
--public void testAddRoles() - throws AuthenticationException-
-
-
- Test of addRoles method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testChangePassword
--public void testChangePassword() - throws java.lang.Exception-
-
-
- Test of changePassword method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testDisable
--public void testDisable() - throws AuthenticationException-
-
-
- Test of disable method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testEnable
--public void testEnable() - throws AuthenticationException-
-
-
- Test of enable method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testEquals
--public void testEquals() - throws AuthenticationException-
-
-
- Test equals.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testFailedLoginLockout
--public void testFailedLoginLockout() - throws AuthenticationException, - EncryptionException-
-
-
- Test of failedLoginCount lockout, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception -EncryptionException
- -
-testGetAccountName
--public void testGetAccountName() - throws AuthenticationException-
-
-
- Test of getAccountName method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testGetLastFailedLoginTime
--public void testGetLastFailedLoginTime() - throws java.lang.Exception-
-
-
- Test get last failed login time.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testGetLastLoginTime
--public void testGetLastLoginTime() - throws java.lang.Exception-
-
-
- Test get last login time.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testGetLastPasswordChangeTime
--public void testGetLastPasswordChangeTime() - throws java.lang.Exception-
-
-
- Test of getLastPasswordChangeTime method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testGetRoles
--public void testGetRoles() - throws java.lang.Exception-
-
-
- Test of getRoles method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testGetScreenName
--public void testGetScreenName() - throws AuthenticationException-
-
-
- Test of xxx method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testIncrementFailedLoginCount
--public void testIncrementFailedLoginCount() - throws AuthenticationException-
-
-
- Test of incrementFailedLoginCount method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testIsEnabled
--public void testIsEnabled() - throws AuthenticationException-
-
-
- Test of isEnabled method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testIsInRole
--public void testIsInRole() - throws AuthenticationException-
-
-
- Test of isInRole method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testIsLocked
--public void testIsLocked() - throws AuthenticationException-
-
-
- Test of xxx method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testIsSessionAbsoluteTimeout
--public void testIsSessionAbsoluteTimeout() - throws AuthenticationException-
-
-
- Test of isSessionAbsoluteTimeout method, of class
- org.owasp.esapi.IntrusionDetector.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testIsSessionTimeout
--public void testIsSessionTimeout() - throws AuthenticationException-
-
-
- Test of isSessionTimeout method, of class
- org.owasp.esapi.IntrusionDetector.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testLock
--public void testLock() - throws AuthenticationException-
-
-
- Test of lockAccount method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testLoginWithPassword
--public void testLoginWithPassword() - throws AuthenticationException-
-
-
- Test of loginWithPassword method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testLogout
--public void testLogout() - throws AuthenticationException-
-
-
- Test of logout method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testRemoveRole
--public void testRemoveRole() - throws AuthenticationException-
-
-
- Test of testRemoveRole method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testResetCSRFToken
--public void testResetCSRFToken() - throws AuthenticationException-
-
-
- Test of testResetCSRFToken method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testResetPassword
--public void testResetPassword() - throws AuthenticationException, - EncryptionException-
-
-
- Test reset password.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception -EncryptionException
- -
-testResetRememberToken
--public void testResetRememberToken() - throws AuthenticationException-
-
-
- Test of generateRememberMeToken method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testSetAccountName
--public void testSetAccountName() - throws AuthenticationException-
-
-
- Test of setAccountName method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException
- -
-testSetExpirationTime
--public void testSetExpirationTime() - throws java.lang.Exception-
-
-
- Test of setExpirationTime method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testSetRoles
--public void testSetRoles() - throws AuthenticationException-
-
-
- Test of setRoles method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testSetScreenName
--public void testSetScreenName() - throws AuthenticationException-
-
-
- Test of setScreenName method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testUnlock
--public void testUnlock() - throws AuthenticationException-
-
-
- Test of unlockAccount method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/ValidationAvailabilityException.html b/javadoc/org/owasp/esapi/ValidationAvailabilityException.html deleted file mode 100644 index bfa38f9c1..000000000 --- a/javadoc/org/owasp/esapi/ValidationAvailabilityException.html +++ /dev/null @@ -1,277 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class ValidationAvailabilityException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class ValidationAvailabilityException
- extends ValidationException
-FIXME: DOC. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
ValidationAvailabilityException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Create a new ValidationException |
-|
ValidationAvailabilityException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Create a new ValidationException |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ValidationAvailabilityException
--public ValidationAvailabilityException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Create a new ValidationException
-
-
- Parameters:
userMessage-logMessage-
- -
-ValidationAvailabilityException
--public ValidationAvailabilityException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Create a new ValidationException
-
-
- Parameters:
userMessage-logMessage-cause-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/ValidationErrorList.html b/javadoc/org/owasp/esapi/ValidationErrorList.html deleted file mode 100644 index 13e30a296..000000000 --- a/javadoc/org/owasp/esapi/ValidationErrorList.html +++ /dev/null @@ -1,408 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class ValidationErrorList
--java.lang.Object --
-
-
-
- public class ValidationErrorList
- extends java.lang.Object
-The ValidationErrorList class defines a well-formed collection of - ValidationExceptions so that groups of validation functions can be - called in a non-blocking fashion. - -
-
-
- - To use the ValidationErrorList to execute groups of validation - attempts, your controller code would look something like: - -
- ValidationErrorList() errorList = new ValidationErrorList();.
- String name = getValidInput("Name", form.getName(), "SomeESAPIRegExName1", 255, false, errorList);
- String address = getValidInput("Address", form.getAddress(), "SomeESAPIRegExName2", 255, false, errorList);
- Integer weight = getValidInteger("Weight", form.getWeight(), 1, 1000000000, false, errorList);
- Integer sortOrder = getValidInteger("Sort Order", form.getSortOrder(), -100000, +100000, false, errorList);
- request.setAttribute( "ERROR_LIST", errorList );
-
-
- The at your view layer you would be able to retrieve all
- of your error messages via a helper function like:
-
-
- public static ValidationErrorList getErrors() {
- HttpServletRequest request = ESAPI.httpUtilities().getCurrentRequest();
- ValidationErrorList errors = new ValidationErrorList();
- if (request.getAttribute(Constants.ERROR_LIST) != null) {
- errors = (ValidationErrorList)request.getAttribute("ERROR_LIST");
- }
- return errors;
- }
-
-
- You can list all errors like:
-
-
- <%
- for (Object vo : errorList.errors()) {
- ValidationException ve = (ValidationException)vo;
- %>
- <%= ESAPI.encoder().encodeForHTML(ve.getMessage()) %>
- <%
- }
- %>
-
-
- And even check if a specific UI component is in error via calls like:
-
-
- ValidationException e = errorList.getError("Name");
-
-- -
-
-
-
- Since: -
- August 15, 2008 -
- Author: -
- Jim Manico (jim.manico .at. aspectsecurity.com) - Aspect Security -
- -
| -Constructor Summary | -|
ValidationErrorList()
-
-- |
-|
| -Method Summary | -|
- void |
-addError(java.lang.String context,
- ValidationException ve)
-
-- Adds a new error to list with a unique named context. |
-
- java.util.List |
-errors()
-
-- Returns list of ValidationException, or empty list of no errors exist. |
-
- ValidationException |
-getError(java.lang.String context)
-
-- Retrieves ValidationException for given context if one exists. |
-
- boolean |
-isEmpty()
-
-- Returns true if no error are present. |
-
- int |
-size()
-
-- Returns the numbers of errors present. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-ValidationErrorList
--public ValidationErrorList()-
-
-
| -Method Detail | -
-addError
--public void addError(java.lang.String context, - ValidationException ve)-
-
-
- Adds a new error to list with a unique named context.
- No action taken if either element is null.
- Existing contexts will be overwritten.
-
-
-
-
- Parameters:
context- unique named context for this ValidationErrorListve-
- -
-errors
--public java.util.List errors()-
-
-
- Returns list of ValidationException, or empty list of no errors exist.
-
-
-
-
-
- Returns:
- List
- -
-getError
--public ValidationException getError(java.lang.String context)-
-
-
- Retrieves ValidationException for given context if one exists.
-
-
-
-
- Parameters:
context- unique name for each error -- Returns:
- ValidationException or null for given context
- -
-isEmpty
--public boolean isEmpty()-
-
-
- Returns true if no error are present.
-
-
-
-
-
- Returns:
- boolean
- -
-size
--public int size()-
-
-
- Returns the numbers of errors present.
-
-
-
-
-
- Returns:
- boolean
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/ValidationException.html b/javadoc/org/owasp/esapi/ValidationException.html deleted file mode 100644 index c4b0ded5a..000000000 --- a/javadoc/org/owasp/esapi/ValidationException.html +++ /dev/null @@ -1,281 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class ValidationException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
- Direct Known Subclasses:
- ValidationAvailabilityException, ValidationUploadException -
-
-
-
- public class ValidationException
- extends EnterpriseSecurityException
-A ValidationException should be thrown to indicate that the data provided by - the user or from some other external source does not match the validation - rules that have been specified for that data. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
ValidationException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of ValidationException. |
-|
ValidationException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new ValidationException. |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ValidationException
--public ValidationException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of ValidationException.
-
-
- -
-ValidationException
--public ValidationException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new ValidationException.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/ValidationUploadException.html b/javadoc/org/owasp/esapi/ValidationUploadException.html deleted file mode 100644 index 4d39d6426..000000000 --- a/javadoc/org/owasp/esapi/ValidationUploadException.html +++ /dev/null @@ -1,277 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class ValidationUploadException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class ValidationUploadException
- extends ValidationException
-FIXME: DOC. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
ValidationUploadException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Create a new ValidationException |
-|
ValidationUploadException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Create a new ValidationException |
-|
| Methods inherited from class org.owasp.esapi.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ValidationUploadException
--public ValidationUploadException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Create a new ValidationException
-
-
- Parameters:
userMessage-logMessage-
- -
-ValidationUploadException
--public ValidationUploadException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Create a new ValidationException
-
-
- Parameters:
userMessage-logMessage-cause-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/Validator.html b/javadoc/org/owasp/esapi/Validator.html deleted file mode 100644 index 143e7ac71..000000000 --- a/javadoc/org/owasp/esapi/Validator.html +++ /dev/null @@ -1,1926 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Interface Validator
--
-
- All Known Implementing Classes:
- DefaultValidator -
-
-
-
- public interface Validator
-The Validator interface defines a set of methods for canonicalizing and - validating untrusted input. Implementors should feel free to extend this - interface to accommodate their own data formats. Rather than throw exceptions, - this interface returns boolean results because not all validation problems - are security issues. Boolean returns allow developers to handle both valid - and invalid results more cleanly than exceptions. -
-
-
- Implementations must adopt a "whitelist" approach to validation where a - specific pattern or character set is matched. "Blacklist" approaches that - attempt to identify the invalid or disallowed characters are much more likely - to allow a bypass with encoding or other tricks. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- void |
-assertIsValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- void |
-assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- void |
-assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional,
- ValidationErrorList errorList)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- void |
-assertValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Validates the filepath, filename, and content of a file. |
-
- void |
-assertValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Validates the filepath, filename, and content of a file. |
-
- java.lang.String |
-getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- java.lang.String |
-getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- java.util.Date |
-getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns a valid date as a Date. |
-
- java.util.Date |
-getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a valid date as a Date. |
-
- java.lang.String |
-getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- java.lang.String |
-getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- java.lang.Double |
-getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns a validated real number as a double. |
-
- java.lang.Double |
-getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a validated real number as a double. |
-
- byte[] |
-getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns validated file content as a byte array. |
-
- byte[] |
-getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns validated file content as a byte array. |
-
- java.lang.String |
-getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated file name as a String. |
-
- java.lang.String |
-getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a canonicalized and validated file name as a String. |
-
- java.lang.String |
-getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated input as a String. |
-
- java.lang.String |
-getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns canonicalized and validated input as a String. |
-
- java.lang.Integer |
-getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns a validated integer. |
-
- java.lang.Integer |
-getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a validated integer. |
-
- java.lang.String |
-getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- java.lang.String |
-getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list,
- ValidationErrorList errorList)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- java.lang.Double |
-getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double within the range of minValue to maxValue. |
-
- java.lang.Double |
-getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a validated number as a double within the range of minValue to maxValue. |
-
- byte[] |
-getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a byte array. |
-
- byte[] |
-getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns canonicalized and validated printable characters as a byte array. |
-
- java.lang.String |
-getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a String. |
-
- java.lang.String |
-getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns canonicalized and validated printable characters as a String. |
-
- java.lang.String |
-getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated redirect location as a String. |
-
- java.lang.String |
-getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a canonicalized and validated redirect location as a String. |
-
- java.lang.String |
-getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated "safe" HTML. |
-
- java.lang.String |
-getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns canonicalized and validated "safe" HTML. |
-
- boolean |
-isValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid credit card. |
-
- boolean |
-isValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns true if input is a valid date according to the specified date format. |
-
- boolean |
-isValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid directory path. |
-
- boolean |
-isValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid double within the range of minValue to maxValue. |
-
- boolean |
-isValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if input is valid file content. |
-
- boolean |
-isValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid file name. |
-
- boolean |
-isValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if a file upload has a valid name, path, and content. |
-
- boolean |
-isValidHTTPRequest()
-
-- Validate the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- boolean |
-isValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Returns true if the parameters in the current request contain all required parameters and only optional ones in addition. |
-
- boolean |
-isValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input is valid according to the specified type. |
-
- boolean |
-isValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid integer within the range of minValue to maxValue. |
-
- boolean |
-isValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns true if input is a valid list item. |
-
- boolean |
-isValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid number within the range of minValue to maxValue. |
-
- boolean |
-isValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input contains only valid printable ASCII characters. |
-
- boolean |
-isValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input contains only valid printable ASCII characters (32-126). |
-
- boolean |
-isValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid redirect location, as defined by "ESAPI.properties". |
-
- boolean |
-isValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input is "safe" HTML. |
-
- java.lang.String |
-safeReadLine(java.io.InputStream inputStream,
- int maxLength)
-
-- Reads from an input stream until end-of-line or a maximum number of - characters. |
-
| -Method Detail | -
-isValidInput
--public boolean isValidInput(java.lang.String context, - java.lang.String input, - java.lang.String type, - int maxLength, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is valid according to the specified type. The type parameter must be the name
- of a defined type in the ESAPI configuration or a valid regular expression. Implementers should take
- care to make the type storage simple to understand and configure.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.type- The regular expression name that maps to the actual regular expression from "ESAPI.properties".maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if the input is valid based on the rules set by 'type' -
- Throws: -
IntrusionException
- -
-getValidInput
--public java.lang.String getValidInput(java.lang.String context, - java.lang.String input, - java.lang.String type, - int maxLength, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns canonicalized and validated input as a String. Invalid input will generate a descriptive ValidationException,
- and input that is clearly an attack will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.type- The regular expression name that maps to the actual regular expression from "ESAPI.properties".maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- The canonicalized user input. -
- Throws: -
ValidationException-IntrusionException
- -
-getValidInput
--public java.lang.String getValidInput(java.lang.String context, - java.lang.String input, - java.lang.String type, - int maxLength, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns canonicalized and validated input as a String. Invalid input will generate a descriptive ValidationException,
- and input that is clearly an attack will generate a descriptive IntrusionException. Instead of
- throwing a ValidationException on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.type- The regular expression name that maps to the actual regular expression from "ESAPI.properties".maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- The canonicalized user input. -
- Throws: -
IntrusionException
- -
-isValidDate
--public boolean isValidDate(java.lang.String context, - java.lang.String input, - java.text.DateFormat format, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid date according to the specified date format.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.format- Required formatting of date inputted.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid date according to the format specified by 'format' -
- Throws: -
IntrusionException
- -
-getValidDate
--public java.util.Date getValidDate(java.lang.String context, - java.lang.String input, - java.text.DateFormat format, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a valid date as a Date. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.format- Required formatting of date inputted.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- A valid date as a Date -
- Throws: -
ValidationException-IntrusionException
- -
-getValidDate
--public java.util.Date getValidDate(java.lang.String context, - java.lang.String input, - java.text.DateFormat format, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns a valid date as a Date. Invalid input will generate a descriptive ValidationException and store it inside of
- the errorList argument, and input that is clearly an attack will generate a descriptive IntrusionException. Instead of
- throwing a ValidationException on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.format- Required formatting of date inputted.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A valid date as a Date -
- Throws: -
IntrusionException
- -
-isValidSafeHTML
--public boolean isValidSafeHTML(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is "safe" HTML. Implementors should reference the OWASP AntiSamy project for ideas
- on how to do HTML validation in a whitelist way, as this is an extremely difficult problem.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is valid safe HTML -
- Throws: -
IntrusionException
- -
-getValidSafeHTML
--public java.lang.String getValidSafeHTML(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns canonicalized and validated "safe" HTML. Implementors should reference the OWASP AntiSamy project for ideas
- on how to do HTML validation in a whitelist way, as this is an extremely difficult problem.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- Valid safe HTML -
- Throws: -
ValidationException-IntrusionException
- -
-getValidSafeHTML
--public java.lang.String getValidSafeHTML(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns canonicalized and validated "safe" HTML. Implementors should reference the OWASP AntiSamy project for ideas
- on how to do HTML validation in a whitelist way, as this is an extremely difficult problem. Instead of
- throwing a ValidationException on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- Valid safe HTML -
- Throws: -
IntrusionException
- -
-isValidCreditCard
--public boolean isValidCreditCard(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid credit card. Maxlength is mandated by valid credit card type.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid credit card number -
- Throws: -
IntrusionException
- -
-getValidCreditCard
--public java.lang.String getValidCreditCard(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a canonicalized and validated credit card number as a String. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- A valid credit card number -
- Throws: -
ValidationException-IntrusionException
- -
-getValidCreditCard
--public java.lang.String getValidCreditCard(java.lang.String context, - java.lang.String input, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns a canonicalized and validated credit card number as a String. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A valid credit card number -
- Throws: -
IntrusionException
- -
-isValidDirectoryPath
--public boolean isValidDirectoryPath(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid directory path.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid directory path -
- Throws: -
IntrusionException
- -
-getValidDirectoryPath
--public java.lang.String getValidDirectoryPath(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a canonicalized and validated directory path as a String. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- A valid directory path -
- Throws: -
ValidationException-IntrusionException
- -
-getValidDirectoryPath
--public java.lang.String getValidDirectoryPath(java.lang.String context, - java.lang.String input, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns a canonicalized and validated directory path as a String. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A valid directory path -
- Throws: -
IntrusionException
- -
-isValidFileName
--public boolean isValidFileName(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid file name.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid file name -
- Throws: -
IntrusionException
- -
-getValidFileName
--public java.lang.String getValidFileName(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a canonicalized and validated file name as a String. Implementors should check for allowed file extensions here, as well as allowed file name characters, as declared in "ESAPI.properties". Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- A valid file name -
- Throws: -
ValidationException-IntrusionException
- -
-getValidFileName
--public java.lang.String getValidFileName(java.lang.String context, - java.lang.String input, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns a canonicalized and validated file name as a String. Implementors should check for allowed file extensions here, as well as allowed file name characters, as declared in "ESAPI.properties". Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A valid file name -
- Throws: -
IntrusionException
- -
-isValidNumber
--public boolean isValidNumber(java.lang.String context, - java.lang.String input, - long minValue, - long maxValue, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid number within the range of minValue to maxValue.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.minValue- Lowest legal value for input.maxValue- Highest legal value for input.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid number -
- Throws: -
IntrusionException
- -
-getValidNumber
--public java.lang.Double getValidNumber(java.lang.String context, - java.lang.String input, - long minValue, - long maxValue, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a validated number as a double within the range of minValue to maxValue. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.minValue- Lowest legal value for input.maxValue- Highest legal value for input. -- Returns:
- A validated number as a double. -
- Throws: -
ValidationException-IntrusionException
- -
-getValidNumber
--public java.lang.Double getValidNumber(java.lang.String context, - java.lang.String input, - long minValue, - long maxValue, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns a validated number as a double within the range of minValue to maxValue. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.minValue- Lowest legal value for input.maxValue- Highest legal value for input.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A validated number as a double. -
- Throws: -
IntrusionException
- -
-isValidInteger
--public boolean isValidInteger(java.lang.String context, - java.lang.String input, - int minValue, - int maxValue, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid integer within the range of minValue to maxValue.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.minValue- Lowest legal value for input.maxValue- Highest legal value for input.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid integer -
- Throws: -
IntrusionException
- -
-getValidInteger
--public java.lang.Integer getValidInteger(java.lang.String context, - java.lang.String input, - int minValue, - int maxValue, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a validated integer. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.minValue- Lowest legal value for input.maxValue- Highest legal value for input. -- Returns:
- A validated number as an integer. -
- Throws: -
ValidationException-IntrusionException
- -
-getValidInteger
--public java.lang.Integer getValidInteger(java.lang.String context, - java.lang.String input, - int minValue, - int maxValue, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns a validated integer. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.minValue- Lowest legal value for input.maxValue- Highest legal value for input.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A validated number as an integer. -
- Throws: -
IntrusionException
- -
-isValidDouble
--public boolean isValidDouble(java.lang.String context, - java.lang.String input, - double minValue, - double maxValue, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid double within the range of minValue to maxValue.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.minValue- Lowest legal value for input.maxValue- Highest legal value for input.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid double. -
- Throws: -
IntrusionException
- -
-getValidDouble
--public java.lang.Double getValidDouble(java.lang.String context, - java.lang.String input, - double minValue, - double maxValue, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a validated real number as a double. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.minValue- Lowest legal value for input.maxValue- Highest legal value for input. -- Returns:
- A validated real number as a double. -
- Throws: -
ValidationException-IntrusionException
- -
-getValidDouble
--public java.lang.Double getValidDouble(java.lang.String context, - java.lang.String input, - double minValue, - double maxValue, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns a validated real number as a double. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.minValue- Lowest legal value for input.maxValue- Highest legal value for input.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A validated real number as a double. -
- Throws: -
IntrusionException
- -
-isValidFileContent
--public boolean isValidFileContent(java.lang.String context, - byte[] input, - int maxBytes, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is valid file content. This is a good place to check for max file size, allowed character sets, and do virus scans.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.maxBytes- The maximum number of bytes allowed in a legal file.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input contains valid file content. -
- Throws: -
IntrusionException
- -
-getValidFileContent
--public byte[] getValidFileContent(java.lang.String context, - byte[] input, - int maxBytes, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns validated file content as a byte array. This is a good place to check for max file size, allowed character sets, and do virus scans. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.maxBytes- The maximum number of bytes allowed in a legal file.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- A byte array containing valid file content. -
- Throws: -
ValidationException-IntrusionException
- -
-getValidFileContent
--public byte[] getValidFileContent(java.lang.String context, - byte[] input, - int maxBytes, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns validated file content as a byte array. This is a good place to check for max file size, allowed character sets, and do virus scans. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.maxBytes- The maximum number of bytes allowed in a legal file.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context. -- Returns:
- A byte array containing valid file content. -
- Throws: -
IntrusionException
- -
-isValidFileUpload
--public boolean isValidFileUpload(java.lang.String context, - java.lang.String filepath, - java.lang.String filename, - byte[] content, - int maxBytes, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if a file upload has a valid name, path, and content.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.filepath- The file path of the uploaded file.filename- The filename of the uploaded filecontent- A byte array containing the content of the uploaded file.maxBytes- The max number of bytes allowed for a legal file upload.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if a file upload has a valid name, path, and content. -
- Throws: -
IntrusionException
- -
-assertValidFileUpload
--public void assertValidFileUpload(java.lang.String context, - java.lang.String filepath, - java.lang.String filename, - byte[] content, - int maxBytes, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Validates the filepath, filename, and content of a file. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.filepath- The file path of the uploaded file.filename- The filename of the uploaded filecontent- A byte array containing the content of the uploaded file.maxBytes- The max number of bytes allowed for a legal file upload.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Throws: -
ValidationException-IntrusionException
- -
-assertValidFileUpload
--public void assertValidFileUpload(java.lang.String context, - java.lang.String filepath, - java.lang.String filename, - byte[] content, - int maxBytes, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Validates the filepath, filename, and content of a file. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.filepath- The file path of the uploaded file.filename- The filename of the uploaded filecontent- A byte array containing the content of the uploaded file.maxBytes- The max number of bytes allowed for a legal file upload.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Throws: -
IntrusionException
- -
-isValidHTTPRequest
--public boolean isValidHTTPRequest() - throws IntrusionException-
-
-
- Validate the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed
- characters. See the SecurityConfiguration class for the methods to retrieve the whitelists.
-
-
-
-
-
- Returns:
- true, if is a valid HTTP request -
- Throws: -
IntrusionException
- -
-assertIsValidHTTPRequest
--public void assertIsValidHTTPRequest() - throws ValidationException, - IntrusionException-
-
-
- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed
- characters. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidListItem
--public boolean isValidListItem(java.lang.String context, - java.lang.String input, - java.util.List list) - throws IntrusionException-
-
-
- Returns true if input is a valid list item.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The value to search 'list' for.list- The list to search for 'input'. -- Returns:
- true, if 'input' was found in 'list'. -
- Throws: -
IntrusionException
- -
-getValidListItem
--public java.lang.String getValidListItem(java.lang.String context, - java.lang.String input, - java.util.List list) - throws ValidationException, - IntrusionException-
-
-
- Returns the list item that exactly matches the canonicalized input. Invalid or non-matching input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The value to search 'list' for.list- The list to search for 'input'. -- Returns:
- The list item that exactly matches the canonicalized input. -
- Throws: -
ValidationException-IntrusionException
- -
-getValidListItem
--public java.lang.String getValidListItem(java.lang.String context, - java.lang.String input, - java.util.List list, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns the list item that exactly matches the canonicalized input. Invalid or non-matching input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The value to search 'list' for.list- The list to search for 'input'.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- The list item that exactly matches the canonicalized input. -
- Throws: -
IntrusionException
- -
-isValidHTTPRequestParameterSet
--public boolean isValidHTTPRequestParameterSet(java.lang.String context, - java.util.Set required, - java.util.Set optional) - throws IntrusionException-
-
-
- Returns true if the parameters in the current request contain all required parameters and only optional ones in addition.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.required- parameters that are required to be in HTTP requestoptional- additional parameters that may be in HTTP request -- Returns:
- true, if all required parameters are in HTTP request and only optional parameters in addition. Returns false if parameters are found in HTTP request that are not in either set (required or optional), or if any required parameters are missing from request. -
- Throws: -
IntrusionException
- -
-assertIsValidHTTPRequestParameterSet
--public void assertIsValidHTTPRequestParameterSet(java.lang.String context, - java.util.Set required, - java.util.Set optional) - throws ValidationException, - IntrusionException-
-
-
- Validates that the parameters in the current request contain all required parameters and only optional ones in
- addition. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.required- parameters that are required to be in HTTP requestoptional- additional parameters that may be in HTTP request -- Throws: -
ValidationException-IntrusionException
- -
-assertIsValidHTTPRequestParameterSet
--public void assertIsValidHTTPRequestParameterSet(java.lang.String context, - java.util.Set required, - java.util.Set optional, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Validates that the parameters in the current request contain all required parameters and only optional ones in
- addition. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException on error,
- this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.required- parameters that are required to be in HTTP requestoptional- additional parameters that may be in HTTP requesterrorList- If validation is in error, resulting error will be stored in the errorList by context -- Throws: -
IntrusionException
- -
-isValidPrintable
--public boolean isValidPrintable(java.lang.String context, - byte[] input, - int maxLength, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input contains only valid printable ASCII characters.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- data to be checked for validitymaxLength- Maximum number of bytes stored in 'input'allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if 'input' is less than maxLength and contains only valid, printable characters -
- Throws: -
IntrusionException
- -
-getValidPrintable
--public byte[] getValidPrintable(java.lang.String context, - byte[] input, - int maxLength, - boolean allowNull) - throws ValidationException-
-
-
- Returns canonicalized and validated printable characters as a byte array. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- data to be returned as valid and printablemaxLength- Maximum number of bytes stored in 'input'allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- a byte array containing only printable characters, made up of data from 'input' -
- Throws: -
ValidationException
- -
-getValidPrintable
--public byte[] getValidPrintable(java.lang.String context, - byte[] input, - int maxLength, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns canonicalized and validated printable characters as a byte array. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException on error,
- this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- data to be returned as valid and printablemaxLength- Maximum number of bytes stored in 'input'allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- a byte array containing only printable characters, made up of data from 'input' -
- Throws: -
IntrusionException
- -
-isValidPrintable
--public boolean isValidPrintable(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input contains only valid printable ASCII characters (32-126).
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- data to be checked for validitymaxLength- Maximum number of bytes stored in 'input' after canonicalizationallowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if 'input' is less than maxLength after canonicalization and contains only valid, printable characters -
- Throws: -
IntrusionException
- -
-getValidPrintable
--public java.lang.String getValidPrintable(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull) - throws ValidationException-
-
-
- Returns canonicalized and validated printable characters as a String. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- data to be returned as valid and printablemaxLength- Maximum number of bytes stored in 'input' after canonicalizationallowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- a String containing only printable characters, made up of data from 'input' -
- Throws: -
ValidationException
- -
-getValidPrintable
--public java.lang.String getValidPrintable(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns canonicalized and validated printable characters as a String. Invalid input will generate
- a descriptive ValidationException, and input that is clearly an attack will generate a
- descriptive IntrusionException. Instead of throwing a ValidationException on error,
- this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- data to be returned as valid and printablemaxLength- Maximum number of bytes stored in 'input' after canonicalizationallowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- a String containing only printable characters, made up of data from 'input' -
- Throws: -
IntrusionException
- -
-isValidRedirectLocation
--public boolean isValidRedirectLocation(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid redirect location, as defined by "ESAPI.properties".
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- redirect location to be checked for validity, according to rules set in "ESAPI.properties"allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if 'input' is a valid redirect location, as defined by "ESAPI.properties", false otherwise. -
- Throws: -
IntrusionException
- -
-getValidRedirectLocation
--public java.lang.String getValidRedirectLocation(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a canonicalized and validated redirect location as a String. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- redirect location to be returned as valid, according to encoding rules set in "ESAPI.properties"allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- A canonicalized and validated redirect location, as defined in "ESAPI.properties" -
- Throws: -
ValidationException-IntrusionException
- -
-getValidRedirectLocation
--public java.lang.String getValidRedirectLocation(java.lang.String context, - java.lang.String input, - boolean allowNull, - ValidationErrorList errorList) - throws IntrusionException-
-
-
- Returns a canonicalized and validated redirect location as a String. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- redirect location to be returned as valid, according to encoding rules set in "ESAPI.properties"allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errorList- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A canonicalized and validated redirect location, as defined in "ESAPI.properties" -
- Throws: -
IntrusionException
- -
-safeReadLine
--public java.lang.String safeReadLine(java.io.InputStream inputStream, - int maxLength) - throws ValidationException-
-
-
- Reads from an input stream until end-of-line or a maximum number of
- characters. This method protects against the inherent denial of service
- attack in reading until the end of a line. If an attacker doesn't ever
- send a newline character, then a normal input stream reader will read
- until all memory is exhausted and the platform throws an OutOfMemoryError
- and probably terminates.
-
-
-
-
- Parameters:
inputStream- The InputStream from which to read datamaxLength- Maximum characters allowed to be read in per line -- Returns:
- a String containing the current line of inputStream -
- Throws: -
ValidationException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/ValidatorTest.html b/javadoc/org/owasp/esapi/ValidatorTest.html deleted file mode 100644 index 71caaa911..000000000 --- a/javadoc/org/owasp/esapi/ValidatorTest.html +++ /dev/null @@ -1,605 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi
-
-Class ValidatorTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class ValidatorTest
- extends junit.framework.TestCase
-The Class ValidatorTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
ValidatorTest(java.lang.String testName)
-
-- Instantiates a new validator test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testGetValidDate()
-
-- Test of getValidDate method, of class org.owasp.esapi.Validator. |
-
- void |
-testGetValidSafeHTML()
-
-- Test of getValidSafeHTML method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidCreditCard()
-
-- Test of isValidCreditCard method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidDirectoryPath()
-
-- Test of isValidDirectoryPath method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidFileContent()
-
-- Test of isValidFileContent method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidFileName()
-
-- Test of isValidFileName method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidFileUpload()
-
-- Test of isValidFileUpload method, of class org.owasp.esapi.Validator. |
-
- void |
-testisValidInput()
-
-- Test of isValidEmailAddress method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidInteger()
-
-- |
-
- void |
-testIsValidListItem()
-
-- Test of isValidListItem method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidNumber()
-
-- Test of isValidNumber method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidParameterSet()
-
-- Test of isValidParameterSet method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidPrintable()
-
-- |
-
- void |
-testIsValidSafeHTML()
-
-- Test of isValidSafeHTML method, of class org.owasp.esapi.Validator. |
-
- void |
-testSafeReadLine()
-
-- Test safe read line. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ValidatorTest
--public ValidatorTest(java.lang.String testName)-
-
-
- Instantiates a new validator test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testIsValidCreditCard
--public void testIsValidCreditCard()-
-
-
- Test of isValidCreditCard method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testisValidInput
--public void testisValidInput()-
-
-
- Test of isValidEmailAddress method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidSafeHTML
--public void testIsValidSafeHTML()-
-
-
- Test of isValidSafeHTML method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testGetValidSafeHTML
--public void testGetValidSafeHTML() - throws java.lang.Exception-
-
-
- Test of getValidSafeHTML method, of class org.owasp.esapi.Validator.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testIsValidListItem
--public void testIsValidListItem()-
-
-
- Test of isValidListItem method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidNumber
--public void testIsValidNumber()-
-
-
- Test of isValidNumber method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidInteger
--public void testIsValidInteger()-
-
-
-
-
-
- -
-testGetValidDate
--public void testGetValidDate() - throws java.lang.Exception-
-
-
- Test of getValidDate method, of class org.owasp.esapi.Validator.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testIsValidFileName
--public void testIsValidFileName()-
-
-
- Test of isValidFileName method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidDirectoryPath
--public void testIsValidDirectoryPath()-
-
-
- Test of isValidDirectoryPath method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidPrintable
--public void testIsValidPrintable()-
-
-
-
-
-
- -
-testIsValidFileContent
--public void testIsValidFileContent()-
-
-
- Test of isValidFileContent method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidFileUpload
--public void testIsValidFileUpload()-
-
-
- Test of isValidFileUpload method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidParameterSet
--public void testIsValidParameterSet()-
-
-
- Test of isValidParameterSet method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testSafeReadLine
--public void testSafeReadLine()-
-
-
- Test safe read line.
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/AccessControlException.html b/javadoc/org/owasp/esapi/class-use/AccessControlException.html deleted file mode 100644 index b23d606f6..000000000 --- a/javadoc/org/owasp/esapi/class-use/AccessControlException.html +++ /dev/null @@ -1,333 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.AccessControlException
-| -Packages that use AccessControlException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -Reference implementations of the ESAPI interfaces. | -
| -Uses of AccessControlException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that throw AccessControlException | -|
- void |
-AccessController.assertAuthorizedForURL(java.lang.String url)
-
-- Checks if an account is authorized to access the referenced URL. |
-
- void |
-AccessController.assertAuthorizedForFunction(java.lang.String functionName)
-
-- Checks if an account is authorized to access the referenced function. |
-
- void |
-AccessController.assertAuthorizedForData(java.lang.String key)
-
-- Checks if an account is authorized to access the referenced data. |
-
- void |
-AccessController.assertAuthorizedForFile(java.lang.String filepath)
-
-- Checks if an account is authorized to access the referenced file. |
-
- void |
-AccessController.assertAuthorizedForService(java.lang.String serviceName)
-
-- Checks if an account is authorized to access the referenced service. |
-
- void |
-HTTPUtilities.assertSecureRequest()
-
-- Ensures that the current request uses SSL and POST to protect any sensitive parameters - in the querystring from being sniffed or logged. |
-
- void |
-HTTPUtilities.safeSendForward(java.lang.String context,
- java.lang.String location)
-
-- This method perform a forward to any resource located inside the WEB-INF directory. |
-
- java.lang.Object |
-AccessReferenceMap.getDirectReference(java.lang.String indirectReference)
-
-- Get the original direct object reference from an indirect reference. |
-
- java.lang.String |
-AccessReferenceMap.removeDirectReference(java.lang.Object direct)
-
-- Removes a direct reference and its associated indirect reference from the AccessReferenceMap. |
-
- java.lang.String |
-RandomAccessReferenceMap.removeDirectReference(java.lang.Object direct)
-
-- Remove a direct reference and the corresponding indirect reference. |
-
- java.lang.Object |
-RandomAccessReferenceMap.getDirectReference(java.lang.String indirectReference)
-
-- |
-
| -Uses of AccessControlException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw AccessControlException | -|
- void |
-FileBasedAccessController.assertAuthorizedForURL(java.lang.String url)
-
-- |
-
- void |
-FileBasedAccessController.assertAuthorizedForFunction(java.lang.String functionName)
-
-- |
-
- void |
-FileBasedAccessController.assertAuthorizedForData(java.lang.String key)
-
-- |
-
- void |
-FileBasedAccessController.assertAuthorizedForFile(java.lang.String filepath)
-
-- |
-
- void |
-FileBasedAccessController.assertAuthorizedForService(java.lang.String serviceName)
-
-- |
-
- void |
-DefaultHTTPUtilities.assertSecureRequest()
-
-- Checks the method of the current request. |
-
- void |
-DefaultHTTPUtilities.safeSendForward(java.lang.String context,
- java.lang.String location)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/AccessController.html b/javadoc/org/owasp/esapi/class-use/AccessController.html deleted file mode 100644 index 06f62f2d0..000000000 --- a/javadoc/org/owasp/esapi/class-use/AccessController.html +++ /dev/null @@ -1,218 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.AccessController
-| -Packages that use AccessController | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of AccessController in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return AccessController | -|
-static AccessController |
-ESAPI.accessController()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type AccessController | -|
-static void |
-ESAPI.setAccessController(AccessController accessController)
-
-- |
-
| -Uses of AccessController in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement AccessController | -|
- class |
-FileBasedAccessController
-
-- Reference implementation of the AccessController interface. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/AccessControllerTest.html b/javadoc/org/owasp/esapi/class-use/AccessControllerTest.html deleted file mode 100644 index a88474426..000000000 --- a/javadoc/org/owasp/esapi/class-use/AccessControllerTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.AccessControllerTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/AccessReferenceMap.html b/javadoc/org/owasp/esapi/class-use/AccessReferenceMap.html deleted file mode 100644 index 3e8f7e134..000000000 --- a/javadoc/org/owasp/esapi/class-use/AccessReferenceMap.html +++ /dev/null @@ -1,180 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.AccessReferenceMap
-| -Packages that use AccessReferenceMap | -|
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of AccessReferenceMap in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement AccessReferenceMap | -|
- class |
-IntegerAccessReferenceMap
-
-- Reference implementation of the AccessReferenceMap interface. |
-
- class |
-RandomAccessReferenceMap
-
-- Reference implementation of the AccessReferenceMap interface. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/AccessReferenceMapTest.html b/javadoc/org/owasp/esapi/class-use/AccessReferenceMapTest.html deleted file mode 100644 index c824b8819..000000000 --- a/javadoc/org/owasp/esapi/class-use/AccessReferenceMapTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.AccessReferenceMapTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/AllTests.html b/javadoc/org/owasp/esapi/class-use/AllTests.html deleted file mode 100644 index e232e1f75..000000000 --- a/javadoc/org/owasp/esapi/class-use/AllTests.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.AllTests
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/AuthenticationAccountsException.html b/javadoc/org/owasp/esapi/class-use/AuthenticationAccountsException.html deleted file mode 100644 index 4e233fc8c..000000000 --- a/javadoc/org/owasp/esapi/class-use/AuthenticationAccountsException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.AuthenticationAccountsException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/AuthenticationCredentialsException.html b/javadoc/org/owasp/esapi/class-use/AuthenticationCredentialsException.html deleted file mode 100644 index 1e2ed54d8..000000000 --- a/javadoc/org/owasp/esapi/class-use/AuthenticationCredentialsException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.AuthenticationCredentialsException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/AuthenticationException.html b/javadoc/org/owasp/esapi/class-use/AuthenticationException.html deleted file mode 100644 index 7acd48aa5..000000000 --- a/javadoc/org/owasp/esapi/class-use/AuthenticationException.html +++ /dev/null @@ -1,468 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.AuthenticationException
-| -Packages that use AuthenticationException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -Reference implementations of the ESAPI interfaces. | -
| -Uses of AuthenticationException in org.owasp.esapi | -
- -
| Subclasses of AuthenticationException in org.owasp.esapi | -|
- class |
-AuthenticationAccountsException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
- class |
-AuthenticationCredentialsException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
- class |
-AuthenticationHostException
-
-- An AuthenticationHostException should be thrown when there is a problem with - the host involved with authentication, particularly if the host changes unexpectedly. |
-
- class |
-AuthenticationLoginException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
- -
| Methods in org.owasp.esapi that throw AuthenticationException | -|
- User |
-Authenticator.login(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- Authenticates the user's credentials from the HttpServletRequest if - necessary, creates a session if necessary, and sets the user as the - current user. |
-
- User |
-Authenticator.createUser(java.lang.String accountName,
- java.lang.String password1,
- java.lang.String password2)
-
-- Creates the user. |
-
- void |
-Authenticator.changePassword(User user,
- java.lang.String currentPassword,
- java.lang.String newPassword,
- java.lang.String newPassword2)
-
-- Changes the password for the specified user. |
-
- void |
-Authenticator.removeUser(java.lang.String accountName)
-
-- Removes the account. |
-
- void |
-Authenticator.verifyAccountNameStrength(java.lang.String accountName)
-
-- Ensures that the account name passes site-specific complexity requirements. |
-
- void |
-Authenticator.verifyPasswordStrength(java.lang.String oldPassword,
- java.lang.String newPassword)
-
-- Ensures that the password meets site-specific complexity requirements. |
-
- javax.servlet.http.HttpSession |
-HTTPUtilities.changeSessionIdentifier()
-
-- Invalidate the old session after copying all of its contents to a newly created session with a new session id. |
-
- void |
-User.addRole(java.lang.String role)
-
-- Adds a role to an account. |
-
- void |
-User.addRoles(java.util.Set newRoles)
-
-- Adds the roles. |
-
- void |
-User.changePassword(java.lang.String oldPassword,
- java.lang.String newPassword1,
- java.lang.String newPassword2)
-
-- Sets the user's password, performing a verification of the user's old password, the equality of the two new - passwords, and the strength of the new password. |
-
- java.util.Date |
-User.getLastFailedLoginTime()
-
-- Returns the date of the last failed login time for a user. |
-
- void |
-User.loginWithPassword(java.lang.String password)
-
-- Login with password. |
-
- void |
-User.removeRole(java.lang.String role)
-
-- Removes a role from an account. |
-
- java.lang.String |
-User.resetCSRFToken()
-
-- Returns a token to be used as a prevention against CSRF attacks. |
-
- void |
-User.setRoles(java.util.Set roles)
-
-- Sets the roles. |
-
| -Uses of AuthenticationException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw AuthenticationException | -|
- void |
-DefaultUser.addRole(java.lang.String role)
-
-- |
-
- void |
-DefaultUser.addRoles(java.util.Set newRoles)
-
-- |
-
- void |
-DefaultUser.changePassword(java.lang.String oldPassword,
- java.lang.String newPassword1,
- java.lang.String newPassword2)
-
-- |
-
- void |
-DefaultUser.loginWithPassword(java.lang.String password)
-
-- |
-
- void |
-DefaultUser.setRoles(java.util.Set roles)
-
-- Sets the roles. |
-
- User |
-FileBasedAuthenticator.createUser(java.lang.String accountName,
- java.lang.String password1,
- java.lang.String password2)
-
-- |
-
- void |
-FileBasedAuthenticator.changePassword(User user,
- java.lang.String currentPassword,
- java.lang.String newPassword,
- java.lang.String newPassword2)
-
-- |
-
- void |
-FileBasedAuthenticator.removeUser(java.lang.String accountName)
-
-- |
-
- User |
-FileBasedAuthenticator.login(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- This method should be called for every HTTP request, to login the current user either from the session of HTTP - request. |
-
- void |
-FileBasedAuthenticator.verifyAccountNameStrength(java.lang.String newAccountName)
-
-- |
-
- void |
-FileBasedAuthenticator.verifyPasswordStrength(java.lang.String oldPassword,
- java.lang.String newPassword)
-
-- |
-
- javax.servlet.http.HttpSession |
-DefaultHTTPUtilities.changeSessionIdentifier()
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/AuthenticationHostException.html b/javadoc/org/owasp/esapi/class-use/AuthenticationHostException.html deleted file mode 100644 index 9b9a57860..000000000 --- a/javadoc/org/owasp/esapi/class-use/AuthenticationHostException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.AuthenticationHostException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/AuthenticationLoginException.html b/javadoc/org/owasp/esapi/class-use/AuthenticationLoginException.html deleted file mode 100644 index bb73e741e..000000000 --- a/javadoc/org/owasp/esapi/class-use/AuthenticationLoginException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.AuthenticationLoginException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/Authenticator.html b/javadoc/org/owasp/esapi/class-use/Authenticator.html deleted file mode 100644 index d42404dd9..000000000 --- a/javadoc/org/owasp/esapi/class-use/Authenticator.html +++ /dev/null @@ -1,218 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.Authenticator
-| -Packages that use Authenticator | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of Authenticator in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return Authenticator | -|
-static Authenticator |
-ESAPI.authenticator()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type Authenticator | -|
-static void |
-ESAPI.setAuthenticator(Authenticator authenticator)
-
-- |
-
| -Uses of Authenticator in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement Authenticator | -|
- class |
-FileBasedAuthenticator
-
-- Reference implementation of the Authenticator interface. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/AuthenticatorTest.html b/javadoc/org/owasp/esapi/class-use/AuthenticatorTest.html deleted file mode 100644 index cf962d36d..000000000 --- a/javadoc/org/owasp/esapi/class-use/AuthenticatorTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.AuthenticatorTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/AvailabilityException.html b/javadoc/org/owasp/esapi/class-use/AvailabilityException.html deleted file mode 100644 index e97f13216..000000000 --- a/javadoc/org/owasp/esapi/class-use/AvailabilityException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.AvailabilityException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/CertificateException.html b/javadoc/org/owasp/esapi/class-use/CertificateException.html deleted file mode 100644 index c5170790a..000000000 --- a/javadoc/org/owasp/esapi/class-use/CertificateException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.CertificateException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/ESAPI.html b/javadoc/org/owasp/esapi/class-use/ESAPI.html deleted file mode 100644 index eaa77e3cd..000000000 --- a/javadoc/org/owasp/esapi/class-use/ESAPI.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.ESAPI
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/ESAPITest.html b/javadoc/org/owasp/esapi/class-use/ESAPITest.html deleted file mode 100644 index dd77a6b69..000000000 --- a/javadoc/org/owasp/esapi/class-use/ESAPITest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.ESAPITest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/Encoder.html b/javadoc/org/owasp/esapi/class-use/Encoder.html deleted file mode 100644 index 703bef307..000000000 --- a/javadoc/org/owasp/esapi/class-use/Encoder.html +++ /dev/null @@ -1,218 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.Encoder
-| -Packages that use Encoder | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of Encoder in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return Encoder | -|
-static Encoder |
-ESAPI.encoder()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type Encoder | -|
-static void |
-ESAPI.setEncoder(Encoder encoder)
-
-- |
-
| -Uses of Encoder in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement Encoder | -|
- class |
-DefaultEncoder
-
-- Reference implementation of the Encoder interface. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/EncoderTest.html b/javadoc/org/owasp/esapi/class-use/EncoderTest.html deleted file mode 100644 index 1a0a7fd33..000000000 --- a/javadoc/org/owasp/esapi/class-use/EncoderTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.EncoderTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/EncodingException.html b/javadoc/org/owasp/esapi/class-use/EncodingException.html deleted file mode 100644 index ee0a16cf7..000000000 --- a/javadoc/org/owasp/esapi/class-use/EncodingException.html +++ /dev/null @@ -1,227 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.EncodingException
-| -Packages that use EncodingException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -Reference implementations of the ESAPI interfaces. | -
| -Uses of EncodingException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that throw EncodingException | -|
- java.lang.String |
-Encoder.canonicalize(java.lang.String input)
-
-- This method performs canonicalization on data received to ensure that it - has been reduced to its most basic form before validation. |
-
- java.lang.String |
-Encoder.encodeForURL(java.lang.String input)
-
-- Encode for use in a URL. |
-
- java.lang.String |
-Encoder.decodeFromURL(java.lang.String input)
-
-- Decode from URL. |
-
| -Uses of EncodingException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw EncodingException | -|
- java.lang.String |
-DefaultEncoder.encodeForURL(java.lang.String input)
-
-- |
-
- java.lang.String |
-DefaultEncoder.decodeFromURL(java.lang.String input)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/EncryptedProperties.html b/javadoc/org/owasp/esapi/class-use/EncryptedProperties.html deleted file mode 100644 index a147f58e6..000000000 --- a/javadoc/org/owasp/esapi/class-use/EncryptedProperties.html +++ /dev/null @@ -1,172 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.EncryptedProperties
-| -Packages that use EncryptedProperties | -|
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of EncryptedProperties in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement EncryptedProperties | -|
- class |
-DefaultEncryptedProperties
-
-- Reference implementation of the EncryptedProperties interface. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/EncryptedPropertiesTest.html b/javadoc/org/owasp/esapi/class-use/EncryptedPropertiesTest.html deleted file mode 100644 index 999e60c4d..000000000 --- a/javadoc/org/owasp/esapi/class-use/EncryptedPropertiesTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.EncryptedPropertiesTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/EncryptionException.html b/javadoc/org/owasp/esapi/class-use/EncryptionException.html deleted file mode 100644 index 9132be516..000000000 --- a/javadoc/org/owasp/esapi/class-use/EncryptionException.html +++ /dev/null @@ -1,451 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.EncryptionException
-| -Packages that use EncryptionException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -Reference implementations of the ESAPI interfaces. | -
| -Uses of EncryptionException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that throw EncryptionException | -|
- java.lang.String |
-Authenticator.hashPassword(java.lang.String password,
- java.lang.String accountName)
-
-- Returns a string representation of the hashed password, using the - accountName as the salt. |
-
- java.lang.String |
-HTTPUtilities.encryptHiddenField(java.lang.String value)
-
-- Encrypts a hidden field value for use in HTML. |
-
- java.lang.String |
-HTTPUtilities.encryptQueryString(java.lang.String query)
-
-- Takes a querystring (i.e. |
-
- java.util.Map |
-HTTPUtilities.decryptQueryString(java.lang.String encrypted)
-
-- Takes an encrypted querystring and returns a Map containing the original parameters. |
-
- java.util.Map |
-HTTPUtilities.decryptStateFromCookie()
-
-- Retrieves a map of data from a cookie encrypted with encryptStateInCookie(). |
-
- void |
-HTTPUtilities.encryptStateInCookie(java.util.Map cleartext)
-
-- Stores a Map of data in an encrypted cookie. |
-
- java.lang.String |
-EncryptedProperties.getProperty(java.lang.String key)
-
-- Gets the property value from the encrypted store, decrypts it, and returns the plaintext value to the caller. |
-
- java.lang.String |
-EncryptedProperties.setProperty(java.lang.String key,
- java.lang.String value)
-
-- Encrypts the plaintext property value and stores the ciphertext value in the encrypted store. |
-
- void |
-User.changePassword(java.lang.String oldPassword,
- java.lang.String newPassword1,
- java.lang.String newPassword2)
-
-- Sets the user's password, performing a verification of the user's old password, the equality of the two new - passwords, and the strength of the new password. |
-
- boolean |
-User.verifyPassword(java.lang.String password)
-
-- Verify that the supplied password matches the password for this user. |
-
- java.lang.String |
-Randomizer.getRandomGUID()
-
-- Generates a random GUID. |
-
- java.lang.String |
-Encryptor.hash(java.lang.String plaintext,
- java.lang.String salt)
-
-- Returns a string representation of the hash of the provided plaintext and - salt. |
-
- java.lang.String |
-Encryptor.encrypt(java.lang.String plaintext)
-
-- Encrypts the provided plaintext and returns a ciphertext string. |
-
- java.lang.String |
-Encryptor.decrypt(java.lang.String ciphertext)
-
-- Decrypts the provided ciphertext string (encrypted with the encrypt - method) and returns a plaintext string. |
-
- java.lang.String |
-Encryptor.sign(java.lang.String data)
-
-- Create a digital signature for the provided data and return it in a - string. |
-
- java.lang.String |
-Encryptor.unseal(java.lang.String seal)
-
-- Unseals data (created with the seal method) and throws an exception - describing any of the various problems that could exist with a seal, such - as an invalid seal format, expired timestamp, or decryption error. |
-
| -Uses of EncryptionException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw EncryptionException | -|
- java.lang.String |
-DefaultEncryptedProperties.getProperty(java.lang.String key)
-
-- |
-
- java.lang.String |
-DefaultEncryptedProperties.setProperty(java.lang.String key,
- java.lang.String value)
-
-- |
-
- void |
-DefaultUser.changePassword(java.lang.String oldPassword,
- java.lang.String newPassword1,
- java.lang.String newPassword2)
-
-- |
-
- java.lang.String |
-FileBasedAuthenticator.hashPassword(java.lang.String password,
- java.lang.String accountName)
-
-- |
-
- java.util.Map |
-DefaultHTTPUtilities.decryptQueryString(java.lang.String encrypted)
-
-- |
-
- java.util.Map |
-DefaultHTTPUtilities.decryptStateFromCookie()
-
-- |
-
- java.lang.String |
-DefaultHTTPUtilities.encryptHiddenField(java.lang.String value)
-
-- |
-
- java.lang.String |
-DefaultHTTPUtilities.encryptQueryString(java.lang.String query)
-
-- |
-
- void |
-DefaultHTTPUtilities.encryptStateInCookie(java.util.Map cleartext)
-
-- |
-
- java.lang.String |
-DefaultRandomizer.getRandomGUID()
-
-- |
-
- java.lang.String |
-JSEEncryptor.hash(java.lang.String plaintext,
- java.lang.String salt)
-
-- Hashes the data using the specified algorithm and the Java MessageDigest class. |
-
- java.lang.String |
-JSEEncryptor.encrypt(java.lang.String plaintext)
-
-- |
-
- java.lang.String |
-JSEEncryptor.decrypt(java.lang.String ciphertext)
-
-- |
-
- java.lang.String |
-JSEEncryptor.sign(java.lang.String data)
-
-- |
-
- java.lang.String |
-JSEEncryptor.unseal(java.lang.String seal)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/Encryptor.html b/javadoc/org/owasp/esapi/class-use/Encryptor.html deleted file mode 100644 index a9b0cf08d..000000000 --- a/javadoc/org/owasp/esapi/class-use/Encryptor.html +++ /dev/null @@ -1,218 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.Encryptor
-| -Packages that use Encryptor | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of Encryptor in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return Encryptor | -|
-static Encryptor |
-ESAPI.encryptor()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type Encryptor | -|
-static void |
-ESAPI.setEncryptor(Encryptor encryptor)
-
-- |
-
| -Uses of Encryptor in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement Encryptor | -|
- class |
-JavaEncryptor
-
-- Reference implementation of the Encryptor interface. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/EncryptorTest.html b/javadoc/org/owasp/esapi/class-use/EncryptorTest.html deleted file mode 100644 index 6e968ed38..000000000 --- a/javadoc/org/owasp/esapi/class-use/EncryptorTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.EncryptorTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/EnterpriseSecurityException.html b/javadoc/org/owasp/esapi/class-use/EnterpriseSecurityException.html deleted file mode 100644 index 060d090dc..000000000 --- a/javadoc/org/owasp/esapi/class-use/EnterpriseSecurityException.html +++ /dev/null @@ -1,299 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.EnterpriseSecurityException
-| -Packages that use EnterpriseSecurityException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| -Uses of EnterpriseSecurityException in org.owasp.esapi | -
- -
| Subclasses of EnterpriseSecurityException in org.owasp.esapi | -|
- class |
-AccessControlException
-
-- An AccessControlException should be thrown when a user attempts to access a - resource that they are not authorized for. |
-
- class |
-AuthenticationAccountsException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
- class |
-AuthenticationCredentialsException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
- class |
-AuthenticationException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
- class |
-AuthenticationHostException
-
-- An AuthenticationHostException should be thrown when there is a problem with - the host involved with authentication, particularly if the host changes unexpectedly. |
-
- class |
-AuthenticationLoginException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
- class |
-AvailabilityException
-
-- An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy. |
-
- class |
-CertificateException
-
-- A CertificateException should be thrown for any problems that arise during - processing of digital certificates. |
-
- class |
-EncodingException
-
-- An ExecutorException should be thrown for any problems that occur when - encoding or decoding data. |
-
- class |
-EncryptionException
-
-- An EncryptionException should be thrown for any problems related to - encryption, hashing, or digital signatures. |
-
- class |
-ExecutorException
-
-- An ExecutorException should be thrown for any problems that arise during the - execution of a system executable. |
-
- class |
-IntegrityException
-
-- An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy. |
-
- class |
-ValidationAvailabilityException
-
-- FIXME: DOC. |
-
- class |
-ValidationException
-
-- A ValidationException should be thrown to indicate that the data provided by - the user or from some other external source does not match the validation - rules that have been specified for that data. |
-
- class |
-ValidationUploadException
-
-- FIXME: DOC. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/Executor.html b/javadoc/org/owasp/esapi/class-use/Executor.html deleted file mode 100644 index 26032cfbb..000000000 --- a/javadoc/org/owasp/esapi/class-use/Executor.html +++ /dev/null @@ -1,218 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.Executor
-| -Packages that use Executor | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of Executor in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return Executor | -|
-static Executor |
-ESAPI.executor()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type Executor | -|
-static void |
-ESAPI.setExecutor(Executor executor)
-
-- |
-
| -Uses of Executor in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement Executor | -|
- class |
-DefaultExecutor
-
-- Reference implementation of the Executor interface. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/ExecutorException.html b/javadoc/org/owasp/esapi/class-use/ExecutorException.html deleted file mode 100644 index 606047c15..000000000 --- a/javadoc/org/owasp/esapi/class-use/ExecutorException.html +++ /dev/null @@ -1,210 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.ExecutorException
-| -Packages that use ExecutorException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -Reference implementations of the ESAPI interfaces. | -
| -Uses of ExecutorException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that throw ExecutorException | -|
- java.lang.String |
-Executor.executeSystemCommand(java.io.File executable,
- java.util.List params,
- java.io.File workdir,
- int timeoutSeconds)
-
-- Executes a system command after checking that the executable exists and - that the parameters have not been subject to injection with untrusted - user data. |
-
| -Uses of ExecutorException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw ExecutorException | -|
- java.lang.String |
-DefaultExecutor.executeSystemCommand(java.io.File executable,
- java.util.List params,
- java.io.File workdir,
- int timeoutSeconds)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/ExecutorTest.html b/javadoc/org/owasp/esapi/class-use/ExecutorTest.html deleted file mode 100644 index 8d52cd087..000000000 --- a/javadoc/org/owasp/esapi/class-use/ExecutorTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.ExecutorTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/HTTPUtilities.html b/javadoc/org/owasp/esapi/class-use/HTTPUtilities.html deleted file mode 100644 index b28869ca2..000000000 --- a/javadoc/org/owasp/esapi/class-use/HTTPUtilities.html +++ /dev/null @@ -1,218 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.HTTPUtilities
-| -Packages that use HTTPUtilities | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of HTTPUtilities in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return HTTPUtilities | -|
-static HTTPUtilities |
-ESAPI.httpUtilities()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type HTTPUtilities | -|
-static void |
-ESAPI.setHttpUtilities(HTTPUtilities httpUtilities)
-
-- |
-
| -Uses of HTTPUtilities in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement HTTPUtilities | -|
- class |
-DefaultHTTPUtilities
-
-- Reference implementation of the HTTPUtilities interface. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/HTTPUtilitiesTest.html b/javadoc/org/owasp/esapi/class-use/HTTPUtilitiesTest.html deleted file mode 100644 index 44710f825..000000000 --- a/javadoc/org/owasp/esapi/class-use/HTTPUtilitiesTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.HTTPUtilitiesTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/IntegrityException.html b/javadoc/org/owasp/esapi/class-use/IntegrityException.html deleted file mode 100644 index 5b9e70df1..000000000 --- a/javadoc/org/owasp/esapi/class-use/IntegrityException.html +++ /dev/null @@ -1,204 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.IntegrityException
-| -Packages that use IntegrityException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -Reference implementations of the ESAPI interfaces. | -
| -Uses of IntegrityException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that throw IntegrityException | -|
- java.lang.String |
-Encryptor.seal(java.lang.String data,
- long timestamp)
-
-- Creates a seal that binds a set of data and includes an expiration timestamp. |
-
| -Uses of IntegrityException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw IntegrityException | -|
- java.lang.String |
-JSEEncryptor.seal(java.lang.String data,
- long expiration)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/IntrusionDetector.html b/javadoc/org/owasp/esapi/class-use/IntrusionDetector.html deleted file mode 100644 index 605bfa46a..000000000 --- a/javadoc/org/owasp/esapi/class-use/IntrusionDetector.html +++ /dev/null @@ -1,218 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.IntrusionDetector
-| -Packages that use IntrusionDetector | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of IntrusionDetector in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return IntrusionDetector | -|
-static IntrusionDetector |
-ESAPI.intrusionDetector()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type IntrusionDetector | -|
-static void |
-ESAPI.setIntrusionDetector(IntrusionDetector intrusionDetector)
-
-- |
-
| -Uses of IntrusionDetector in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement IntrusionDetector | -|
- class |
-DefaultIntrusionDetector
-
-- Reference implementation of the IntrusionDetector interface. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/IntrusionDetectorTest.html b/javadoc/org/owasp/esapi/class-use/IntrusionDetectorTest.html deleted file mode 100644 index 4ca292023..000000000 --- a/javadoc/org/owasp/esapi/class-use/IntrusionDetectorTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.IntrusionDetectorTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/IntrusionException.html b/javadoc/org/owasp/esapi/class-use/IntrusionException.html deleted file mode 100644 index 2b11a99da..000000000 --- a/javadoc/org/owasp/esapi/class-use/IntrusionException.html +++ /dev/null @@ -1,925 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.IntrusionException
-| -Packages that use IntrusionException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -Reference implementations of the ESAPI interfaces. | -
| -Uses of IntrusionException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that throw IntrusionException | -|
- void |
-HTTPUtilities.verifyCSRFToken()
-
-- Checks the CSRF token in the URL (see User.getCSRFToken()) against the user's CSRF token and - throws an IntrusionException if it is missing. |
-
- void |
-IntrusionDetector.addException(java.lang.Exception exception)
-
-- Adds the exception to the IntrusionDetector. |
-
- void |
-IntrusionDetector.addEvent(java.lang.String eventName)
-
-- Adds the event to the IntrusionDetector. |
-
- boolean |
-Validator.isValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input is valid according to the specified type. |
-
- java.lang.String |
-Validator.getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated input as a String. |
-
- boolean |
-Validator.isValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns true if input is a valid date according to the specified date format. |
-
- java.util.Date |
-Validator.getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns a valid date as a Date. |
-
- boolean |
-Validator.isValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input is "safe" HTML. |
-
- boolean |
-Validator.isValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid credit card. |
-
- java.lang.String |
-Validator.getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- boolean |
-Validator.isValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid directory path. |
-
- java.lang.String |
-Validator.getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- boolean |
-Validator.isValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid file name. |
-
- java.lang.String |
-Validator.getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated file name as a String. |
-
- boolean |
-Validator.isValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid number. |
-
- java.lang.Double |
-Validator.getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- boolean |
-Validator.isValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid integer. |
-
- java.lang.Integer |
-Validator.getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns a validated integer as an int. |
-
- boolean |
-Validator.isValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid double. |
-
- java.lang.Double |
-Validator.getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns a validated real number as a double. |
-
- boolean |
-Validator.isValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if input is valid file content. |
-
- byte[] |
-Validator.getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns validated file content as a byte array. |
-
- boolean |
-Validator.isValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if a file upload has a valid name, path, and content. |
-
- void |
-Validator.assertValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Validates the filepath, filename, and content of a file. |
-
- boolean |
-Validator.isValidHTTPRequest()
-
-- Validate the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- void |
-Validator.assertIsValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- boolean |
-Validator.isValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns true if input is a valid list item. |
-
- java.lang.String |
-Validator.getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- boolean |
-Validator.isValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Returns true if the parameters in the current request contain all required parameters and only optional ones in addition. |
-
- void |
-Validator.assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- boolean |
-Validator.isValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input is valid printable ASCII characters. |
-
- boolean |
-Validator.isValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input is valid printable ASCII characters (32-126). |
-
- boolean |
-Validator.isValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid redirect location. |
-
| -Uses of IntrusionException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw IntrusionException | -|
- boolean |
-DefaultValidator.isValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Returns true if data received from browser is valid. |
-
- java.lang.String |
-DefaultValidator.getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Validates data received from the browser and returns a safe version. |
-
- boolean |
-DefaultValidator.isValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns true if input is a valid date according to the specified date format. |
-
- java.util.Date |
-DefaultValidator.getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- |
-
- boolean |
-DefaultValidator.isValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- |
-
- java.lang.String |
-DefaultValidator.getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- |
-
- boolean |
-DefaultValidator.isValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- |
-
- java.lang.String |
-DefaultValidator.getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- boolean |
-DefaultValidator.isValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if the directory path (not including a filename) is valid. |
-
- java.lang.String |
-DefaultValidator.getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- boolean |
-DefaultValidator.isValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid file name. |
-
- java.lang.String |
-DefaultValidator.getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated file name as a String. |
-
- boolean |
-DefaultValidator.isValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- |
-
- java.lang.Double |
-DefaultValidator.getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- boolean |
-DefaultValidator.isValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- |
-
- java.lang.Double |
-DefaultValidator.getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- boolean |
-DefaultValidator.isValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- |
-
- java.lang.Integer |
-DefaultValidator.getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- boolean |
-DefaultValidator.isValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if input is valid file content. |
-
- byte[] |
-DefaultValidator.getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns validated file content as a byte array. |
-
- boolean |
-DefaultValidator.isValidFileUpload(java.lang.String context,
- java.lang.String directorypath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if a file upload has a valid name, path, and content. |
-
- void |
-DefaultValidator.assertValidFileUpload(java.lang.String context,
- java.lang.String directorypath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Validates the filepath, filename, and content of a file. |
-
- boolean |
-DefaultValidator.isValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- boolean |
-DefaultValidator.isValidHTTPRequest(javax.servlet.http.HttpServletRequest request)
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- void |
-DefaultValidator.assertIsValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- void |
-DefaultValidator.assertIsValidHTTPRequest(javax.servlet.http.HttpServletRequest request)
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- java.lang.String |
-DefaultValidator.getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- void |
-DefaultValidator.assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- boolean |
-DefaultValidator.isValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Checks that all bytes are valid ASCII characters (between 33 and 126 - inclusive). |
-
- byte[] |
-DefaultValidator.getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a byte array. |
-
- boolean |
-DefaultValidator.isValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- |
-
- java.lang.String |
-DefaultValidator.getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a String. |
-
- boolean |
-DefaultValidator.isValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid redirect location. |
-
- java.lang.String |
-DefaultValidator.getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated redirect location as a String. |
-
- void |
-DefaultIntrusionDetector.addEvent(java.lang.String eventName)
-
-- Adds the event to the IntrusionDetector. |
-
- void |
-DefaultHTTPUtilities.verifyCSRFToken()
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/JavaLogFactory.html b/javadoc/org/owasp/esapi/class-use/JavaLogFactory.html deleted file mode 100644 index 44e9d0e00..000000000 --- a/javadoc/org/owasp/esapi/class-use/JavaLogFactory.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.JavaLogFactory
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/LogFactory.html b/javadoc/org/owasp/esapi/class-use/LogFactory.html deleted file mode 100644 index 064200f09..000000000 --- a/javadoc/org/owasp/esapi/class-use/LogFactory.html +++ /dev/null @@ -1,202 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.LogFactory
-| -Packages that use LogFactory | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of LogFactory in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi with parameters of type LogFactory | -|
-static void |
-ESAPI.setLogFactory(LogFactory factory)
-
-- |
-
| -Uses of LogFactory in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement LogFactory | -|
- class |
-JavaLogFactory
-
-- Reference implementation of the LogFactory and Logger interfaces. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/Logger.html b/javadoc/org/owasp/esapi/class-use/Logger.html deleted file mode 100644 index e32f321dd..000000000 --- a/javadoc/org/owasp/esapi/class-use/Logger.html +++ /dev/null @@ -1,298 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.Logger
-| -Packages that use Logger | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of Logger in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return Logger | -|
- Logger |
-LogFactory.getLogger(java.lang.String name)
-
-- |
-
- Logger |
-LogFactory.getLogger(java.lang.Class clazz)
-
-- |
-
-static Logger |
-ESAPI.getLogger(java.lang.Class clazz)
-
-- |
-
-static Logger |
-ESAPI.getLogger(java.lang.String name)
-
-- |
-
-static Logger |
-ESAPI.log()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type Logger | -|
- void |
-HTTPUtilities.logHTTPRequest(javax.servlet.http.HttpServletRequest request,
- Logger logger)
-
-- Format the Source IP address, URL, URL parameters, and all form - parameters into a string suitable for the log file. |
-
- void |
-HTTPUtilities.logHTTPRequest(javax.servlet.http.HttpServletRequest request,
- Logger logger,
- java.util.List parameterNamesToObfuscate)
-
-- Format the Source IP address, URL, URL parameters, and all form - parameters into a string suitable for the log file. |
-
| -Uses of Logger in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that return Logger | -|
- Logger |
-JavaLogFactory.getLogger(java.lang.Class clazz)
-
-- |
-
- Logger |
-JavaLogFactory.getLogger(java.lang.String name)
-
-- |
-
- -
| Methods in org.owasp.esapi.reference with parameters of type Logger | -|
- void |
-DefaultHTTPUtilities.logHTTPRequest(javax.servlet.http.HttpServletRequest request,
- Logger logger)
-
-- |
-
- void |
-DefaultHTTPUtilities.logHTTPRequest(javax.servlet.http.HttpServletRequest request,
- Logger logger,
- java.util.List parameterNamesToObfuscate)
-
-- Formats an HTTP request into a log suitable string. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/LoggerTest.html b/javadoc/org/owasp/esapi/class-use/LoggerTest.html deleted file mode 100644 index f7514e0b1..000000000 --- a/javadoc/org/owasp/esapi/class-use/LoggerTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.LoggerTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/RandomAccessReferenceMap.html b/javadoc/org/owasp/esapi/class-use/RandomAccessReferenceMap.html deleted file mode 100644 index c41ebb55c..000000000 --- a/javadoc/org/owasp/esapi/class-use/RandomAccessReferenceMap.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.RandomAccessReferenceMap
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/Randomizer.html b/javadoc/org/owasp/esapi/class-use/Randomizer.html deleted file mode 100644 index 41e28fd1f..000000000 --- a/javadoc/org/owasp/esapi/class-use/Randomizer.html +++ /dev/null @@ -1,218 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.Randomizer
-| -Packages that use Randomizer | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of Randomizer in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return Randomizer | -|
-static Randomizer |
-ESAPI.randomizer()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type Randomizer | -|
-static void |
-ESAPI.setRandomizer(Randomizer randomizer)
-
-- |
-
| -Uses of Randomizer in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement Randomizer | -|
- class |
-DefaultRandomizer
-
-- Reference implementation of the Randomizer interface. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/RandomizerTest.html b/javadoc/org/owasp/esapi/class-use/RandomizerTest.html deleted file mode 100644 index 1e3186192..000000000 --- a/javadoc/org/owasp/esapi/class-use/RandomizerTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.RandomizerTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/SafeFile.html b/javadoc/org/owasp/esapi/class-use/SafeFile.html deleted file mode 100644 index 29fe3aa82..000000000 --- a/javadoc/org/owasp/esapi/class-use/SafeFile.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.SafeFile
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/SafeFileTest.html b/javadoc/org/owasp/esapi/class-use/SafeFileTest.html deleted file mode 100644 index ae66ab786..000000000 --- a/javadoc/org/owasp/esapi/class-use/SafeFileTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.SafeFileTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/SecurityConfiguration.Threshold.html b/javadoc/org/owasp/esapi/class-use/SecurityConfiguration.Threshold.html deleted file mode 100644 index f813e6969..000000000 --- a/javadoc/org/owasp/esapi/class-use/SecurityConfiguration.Threshold.html +++ /dev/null @@ -1,202 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.SecurityConfiguration.Threshold
-| -Packages that use SecurityConfiguration.Threshold | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of SecurityConfiguration.Threshold in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return SecurityConfiguration.Threshold | -|
- SecurityConfiguration.Threshold |
-SecurityConfiguration.getQuota(java.lang.String eventName)
-
-- Gets an intrusion detection Quota. |
-
| -Uses of SecurityConfiguration.Threshold in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that return SecurityConfiguration.Threshold | -|
- SecurityConfiguration.Threshold |
-DefaultSecurityConfiguration.getQuota(java.lang.String eventName)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/SecurityConfiguration.html b/javadoc/org/owasp/esapi/class-use/SecurityConfiguration.html deleted file mode 100644 index 2529a0b50..000000000 --- a/javadoc/org/owasp/esapi/class-use/SecurityConfiguration.html +++ /dev/null @@ -1,218 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.SecurityConfiguration
-| -Packages that use SecurityConfiguration | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of SecurityConfiguration in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return SecurityConfiguration | -|
-static SecurityConfiguration |
-ESAPI.securityConfiguration()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type SecurityConfiguration | -|
-static void |
-ESAPI.setSecurityConfiguration(SecurityConfiguration securityConfiguration)
-
-- |
-
| -Uses of SecurityConfiguration in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement SecurityConfiguration | -|
- class |
-DefaultSecurityConfiguration
-
-- The SecurityConfiguration manages all the settings used by the ESAPI in a single place. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/StringUtilities.html b/javadoc/org/owasp/esapi/class-use/StringUtilities.html deleted file mode 100644 index 968c1ecd2..000000000 --- a/javadoc/org/owasp/esapi/class-use/StringUtilities.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.StringUtilities
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/Threshold.html b/javadoc/org/owasp/esapi/class-use/Threshold.html deleted file mode 100644 index 32cba24d9..000000000 --- a/javadoc/org/owasp/esapi/class-use/Threshold.html +++ /dev/null @@ -1,202 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.Threshold
-| -Packages that use Threshold | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| org.owasp.esapi.interfaces | -A set of interfaces modeling the most important security functions to -enterprise web applications. | -
| -Uses of Threshold in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return Threshold | -|
- Threshold |
-SecurityConfiguration.getQuota(java.lang.String eventName)
-
-- |
-
| -Uses of Threshold in org.owasp.esapi.interfaces | -
- -
| Methods in org.owasp.esapi.interfaces that return Threshold | -|
- Threshold |
-ISecurityConfiguration.getQuota(java.lang.String eventName)
-
-- Gets an intrusion detection Quota. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/User.html b/javadoc/org/owasp/esapi/class-use/User.html deleted file mode 100644 index 834b90ebe..000000000 --- a/javadoc/org/owasp/esapi/class-use/User.html +++ /dev/null @@ -1,397 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.User
-| -Packages that use User | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of User in org.owasp.esapi | -
- -
| Fields in org.owasp.esapi declared as User | -|
-static User |
-User.ANONYMOUS
-
-- The ANONYMOUS user is used to represent an unidentified user. |
-
- -
| Methods in org.owasp.esapi that return User | -|
- User |
-Authenticator.login(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- Authenticates the user's credentials from the HttpServletRequest if - necessary, creates a session if necessary, and sets the user as the - current user. |
-
- User |
-Authenticator.createUser(java.lang.String accountName,
- java.lang.String password1,
- java.lang.String password2)
-
-- Creates a new User with the information provided. |
-
- User |
-Authenticator.getUser(long accountId)
-
-- Returns the User matching the provided accountId. |
-
- User |
-Authenticator.getUser(java.lang.String accountName)
-
-- Returns the User matching the provided accountName. |
-
- User |
-Authenticator.getCurrentUser()
-
-- Returns the currently logged in User. |
-
- -
| Methods in org.owasp.esapi with parameters of type User | -|
- boolean |
-Authenticator.verifyPassword(User user,
- java.lang.String password)
-
-- Verify that the supplied password matches the password for this user. |
-
- java.lang.String |
-Authenticator.generateStrongPassword(User user,
- java.lang.String oldPassword)
-
-- Generate strong password that takes into account the user's information and old password. |
-
- void |
-Authenticator.changePassword(User user,
- java.lang.String currentPassword,
- java.lang.String newPassword,
- java.lang.String newPassword2)
-
-- Changes the password for the specified user. |
-
- void |
-Authenticator.setCurrentUser(User user)
-
-- Sets the currently logged in User. |
-
| -Uses of User in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement User | -|
- class |
-DefaultUser
-
-- Reference implementation of the User interface. |
-
- -
| Methods in org.owasp.esapi.reference that return User | -|
- User |
-FileBasedAuthenticator.createUser(java.lang.String accountName,
- java.lang.String password1,
- java.lang.String password2)
-
-- |
-
- User |
-FileBasedAuthenticator.getCurrentUser()
-
-- |
-
- User |
-FileBasedAuthenticator.getUser(long accountId)
-
-- Gets the user object with the matching account name or null if there is no match. |
-
- User |
-FileBasedAuthenticator.getUser(java.lang.String accountName)
-
-- Gets the user object with the matching account name or null if there is no match. |
-
- User |
-FileBasedAuthenticator.login(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- This method should be called for every HTTP request, to login the current user either from the session of HTTP - request. |
-
- -
| Methods in org.owasp.esapi.reference with parameters of type User | -|
- void |
-FileBasedAuthenticator.changePassword(User user,
- java.lang.String currentPassword,
- java.lang.String newPassword,
- java.lang.String newPassword2)
-
-- |
-
- boolean |
-FileBasedAuthenticator.verifyPassword(User user,
- java.lang.String password)
-
-- |
-
- java.lang.String |
-FileBasedAuthenticator.generateStrongPassword(User user,
- java.lang.String oldPassword)
-
-- |
-
- void |
-FileBasedAuthenticator.setCurrentUser(User user)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/UserTest.html b/javadoc/org/owasp/esapi/class-use/UserTest.html deleted file mode 100644 index 339cd9810..000000000 --- a/javadoc/org/owasp/esapi/class-use/UserTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.UserTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/ValidationAvailabilityException.html b/javadoc/org/owasp/esapi/class-use/ValidationAvailabilityException.html deleted file mode 100644 index c18a4957b..000000000 --- a/javadoc/org/owasp/esapi/class-use/ValidationAvailabilityException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.ValidationAvailabilityException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/ValidationErrorList.html b/javadoc/org/owasp/esapi/class-use/ValidationErrorList.html deleted file mode 100644 index 622a00ede..000000000 --- a/javadoc/org/owasp/esapi/class-use/ValidationErrorList.html +++ /dev/null @@ -1,571 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.ValidationErrorList
-| -Packages that use ValidationErrorList | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of ValidationErrorList in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi with parameters of type ValidationErrorList | -|
- java.lang.String |
-Validator.getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns canonicalized and validated input as a String. |
-
- java.util.Date |
-Validator.getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a valid date as a Date. |
-
- java.lang.String |
-Validator.getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns canonicalized and validated "safe" HTML. |
-
- java.lang.String |
-Validator.getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- java.lang.String |
-Validator.getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- java.lang.String |
-Validator.getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a canonicalized and validated file name as a String. |
-
- java.lang.Double |
-Validator.getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a validated number as a double within the range of minValue to maxValue. |
-
- java.lang.Integer |
-Validator.getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a validated integer. |
-
- java.lang.Double |
-Validator.getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a validated real number as a double. |
-
- byte[] |
-Validator.getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns validated file content as a byte array. |
-
- void |
-Validator.assertValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Validates the filepath, filename, and content of a file. |
-
- java.lang.String |
-Validator.getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list,
- ValidationErrorList errorList)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- void |
-Validator.assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional,
- ValidationErrorList errorList)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- byte[] |
-Validator.getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns canonicalized and validated printable characters as a byte array. |
-
- java.lang.String |
-Validator.getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns canonicalized and validated printable characters as a String. |
-
- java.lang.String |
-Validator.getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a canonicalized and validated redirect location as a String. |
-
| -Uses of ValidationErrorList in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference with parameters of type ValidationErrorList | -|
- java.lang.String |
-DefaultValidator.getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errors)
-
-- Validates data received from the browser and returns a safe version. |
-
- java.util.Date |
-DefaultValidator.getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull,
- ValidationErrorList errors)
-
-- |
-
- java.lang.String |
-DefaultValidator.getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidSafeHTML |
-
- java.lang.String |
-DefaultValidator.getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidCreditCard |
-
- java.lang.String |
-DefaultValidator.getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidDirectoryPath |
-
- java.lang.String |
-DefaultValidator.getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errors)
-
-- Returns a canonicalized and validated file name as a String. |
-
- java.lang.Double |
-DefaultValidator.getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull,
- ValidationErrorList errors)
-
-- |
-
- java.lang.Double |
-DefaultValidator.getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull,
- ValidationErrorList errors)
-
-- |
-
- java.lang.Integer |
-DefaultValidator.getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull,
- ValidationErrorList errors)
-
-- |
-
- byte[] |
-DefaultValidator.getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull,
- ValidationErrorList errors)
-
-- |
-
- void |
-DefaultValidator.assertValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of assertValidFileUpload |
-
- java.lang.String |
-DefaultValidator.getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidListItem |
-
- void |
-DefaultValidator.assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of assertIsValidHTTPRequestParameterSet |
-
- byte[] |
-DefaultValidator.getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidPrintable |
-
- java.lang.String |
-DefaultValidator.getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidPrintable |
-
- java.lang.String |
-DefaultValidator.getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidRedirectLocation |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/ValidationException.html b/javadoc/org/owasp/esapi/class-use/ValidationException.html deleted file mode 100644 index 9b07763e3..000000000 --- a/javadoc/org/owasp/esapi/class-use/ValidationException.html +++ /dev/null @@ -1,693 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.ValidationException
-| -Packages that use ValidationException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -Reference implementations of the ESAPI interfaces. | -
| -Uses of ValidationException in org.owasp.esapi | -
- -
| Subclasses of ValidationException in org.owasp.esapi | -|
- class |
-ValidationAvailabilityException
-
-- FIXME: DOC. |
-
- class |
-ValidationUploadException
-
-- FIXME: DOC. |
-
- -
| Methods in org.owasp.esapi that throw ValidationException | -|
- void |
-HTTPUtilities.safeAddHeader(java.lang.String name,
- java.lang.String value)
-
-- Adds a header to an HttpServletResponse after checking for special characters (such as CRLF injection) that could enable - attacks like response splitting and other header-based attacks that nobody has thought of yet. |
-
- void |
-HTTPUtilities.safeSetHeader(java.lang.String name,
- java.lang.String value)
-
-- Sets a header in an HttpServletResponse after checking for special characters (such as CRLF injection) that could enable - attacks like response splitting and other header-based attacks that nobody has thought of yet. |
-
- java.util.List |
-HTTPUtilities.getSafeFileUploads(java.io.File tempDir,
- java.io.File finalDir)
-
-- Extract uploaded files from a multipart HTTP requests. |
-
- java.lang.String |
-Validator.getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated input as a String. |
-
- java.util.Date |
-Validator.getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns a valid date as a Date. |
-
- java.lang.String |
-Validator.getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated "safe" HTML. |
-
- java.lang.String |
-Validator.getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- java.lang.String |
-Validator.getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- java.lang.String |
-Validator.getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated file name as a String. |
-
- java.lang.Double |
-Validator.getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- java.lang.Integer |
-Validator.getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns a validated integer as an int. |
-
- java.lang.Double |
-Validator.getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns a validated real number as a double. |
-
- byte[] |
-Validator.getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns validated file content as a byte array. |
-
- void |
-Validator.assertValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Validates the filepath, filename, and content of a file. |
-
- void |
-Validator.assertIsValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- java.lang.String |
-Validator.getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- void |
-Validator.assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- byte[] |
-Validator.getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a byte array. |
-
- java.lang.String |
-Validator.getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a String. |
-
- java.lang.String |
-Validator.getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated redirect location as a String. |
-
- java.lang.String |
-Validator.safeReadLine(java.io.InputStream inputStream,
- int maxLength)
-
-- Reads from an input stream until end-of-line or a maximum number of - characters. |
-
| -Uses of ValidationException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw ValidationException | -|
- java.lang.String |
-DefaultValidator.getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Validates data received from the browser and returns a safe version. |
-
- java.util.Date |
-DefaultValidator.getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- |
-
- java.lang.String |
-DefaultValidator.getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- |
-
- java.lang.String |
-DefaultValidator.getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- java.lang.String |
-DefaultValidator.getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- java.lang.String |
-DefaultValidator.getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated file name as a String. |
-
- java.lang.Double |
-DefaultValidator.getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- java.lang.Double |
-DefaultValidator.getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- java.lang.Integer |
-DefaultValidator.getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- byte[] |
-DefaultValidator.getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns validated file content as a byte array. |
-
- void |
-DefaultValidator.assertValidFileUpload(java.lang.String context,
- java.lang.String directorypath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Validates the filepath, filename, and content of a file. |
-
- void |
-DefaultValidator.assertIsValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- void |
-DefaultValidator.assertIsValidHTTPRequest(javax.servlet.http.HttpServletRequest request)
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- java.lang.String |
-DefaultValidator.getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- void |
-DefaultValidator.assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- byte[] |
-DefaultValidator.getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a byte array. |
-
- java.lang.String |
-DefaultValidator.getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a String. |
-
- java.lang.String |
-DefaultValidator.getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated redirect location as a String. |
-
- java.lang.String |
-DefaultValidator.safeReadLine(java.io.InputStream in,
- int max)
-
-- This implementation reads until a newline or the specified number of - characters. |
-
- void |
-DefaultHTTPUtilities.safeSetHeader(java.lang.String name,
- java.lang.String value)
-
-- |
-
- java.util.List |
-DefaultHTTPUtilities.getSafeFileUploads(java.io.File tempDir,
- java.io.File finalDir)
-
-- Uses the Apache Commons FileUploader to parse the multipart HTTP request - and extract any files therein. |
-
- -
| Constructors in org.owasp.esapi.reference that throw ValidationException | -|
DefaultSafeFile(java.lang.String path)
-
-- |
-|
DefaultSafeFile(java.lang.String parent,
- java.lang.String child)
-
-- |
-|
DefaultSafeFile(java.io.File parent,
- java.lang.String child)
-
-- |
-|
DefaultSafeFile(java.net.URI uri)
-
-- |
-|
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/ValidationUploadException.html b/javadoc/org/owasp/esapi/class-use/ValidationUploadException.html deleted file mode 100644 index 4616f540e..000000000 --- a/javadoc/org/owasp/esapi/class-use/ValidationUploadException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.ValidationUploadException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/Validator.html b/javadoc/org/owasp/esapi/class-use/Validator.html deleted file mode 100644 index 5bf4a7542..000000000 --- a/javadoc/org/owasp/esapi/class-use/Validator.html +++ /dev/null @@ -1,218 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.Validator
-| -Packages that use Validator | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of Validator in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return Validator | -|
-static Validator |
-ESAPI.validator()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type Validator | -|
-static void |
-ESAPI.setValidator(Validator validator)
-
-- |
-
| -Uses of Validator in org.owasp.esapi.reference | -
- -
| Classes in org.owasp.esapi.reference that implement Validator | -|
- class |
-DefaultValidator
-
-- Reference implementation of the Validator interface. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/class-use/ValidatorTest.html b/javadoc/org/owasp/esapi/class-use/ValidatorTest.html deleted file mode 100644 index 1b62cf389..000000000 --- a/javadoc/org/owasp/esapi/class-use/ValidatorTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.ValidatorTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/Base64.InputStream.html b/javadoc/org/owasp/esapi/codecs/Base64.InputStream.html deleted file mode 100644 index 81e275550..000000000 --- a/javadoc/org/owasp/esapi/codecs/Base64.InputStream.html +++ /dev/null @@ -1,358 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.codecs
-
-Class Base64.InputStream
--java.lang.Object --java.io.InputStream -
-
-
- Enclosing class:
- Base64 -
-
-
-
- public static class Base64.InputStream
- extends java.io.FilterInputStream
-A Base64.InputStream will read data from another
- java.io.InputStream, given in the constructor,
- and encode/decode to/from Base64 notation on the fly.
-
- -
-
-
-
- Since: -
- 1.3 -
- See Also:
Base64
- -
| -Constructor Summary | -|
Base64.InputStream(java.io.InputStream in)
-
-- Constructs a Base64.InputStream in DECODE mode. |
-|
Base64.InputStream(java.io.InputStream in,
- int options)
-
-- Constructs a Base64.InputStream in
- either ENCODE or DECODE mode. |
-|
| -Method Summary | -|
- int |
-read()
-
-- Reads enough of the input stream to convert - to/from Base64 and returns the next byte. |
-
- int |
-read(byte[] dest,
- int off,
- int len)
-
-- Calls read() repeatedly until the end of stream
- is reached or len bytes are read. |
-
| Methods inherited from class java.io.FilterInputStream | -
available, close, mark, markSupported, read, reset, skip |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-Base64.InputStream
--public Base64.InputStream(java.io.InputStream in)-
-
-
- Constructs a
Base64.InputStreamin DECODE mode. --
- Parameters:
in- the java.io.InputStream from which to read data.- Since: -
- 1.3 -
- -
-Base64.InputStream
--public Base64.InputStream(java.io.InputStream in, - int options)-
-
-
- Constructs a
Base64.InputStreamin - either ENCODE or DECODE mode. -- Valid options:
- ENCODE or DECODE: Encode or Decode as data is read. - DONT_BREAK_LINES: don't break lines at 76 characters - (only meaningful when encoding) - Note: Technically, this makes your encoding non-compliant. -
-- Example:
new Base64.InputStream( in, Base64.DECODE )--
- Parameters:
in- the java.io.InputStream from which to read data.options- Specified options- Since: -
- 2.0 -
- See Also:
Base64.ENCODE, -Base64.DECODE, -Base64.DONT_BREAK_LINES
| -Method Detail | -
-read
--public int read() - throws java.io.IOException-
-
-
- Reads enough of the input stream to convert
- to/from Base64 and returns the next byte.
-
-
-
-
-
- Returns:
- next byte -
- Throws: -
java.io.IOException- Since: -
- 1.3 -
- -
-read
--public int read(byte[] dest, - int off, - int len) - throws java.io.IOException-
-
-
- Calls
read()repeatedly until the end of stream - is reached or len bytes are read. - Returns number of bytes read into array or -1 if - end of stream is encountered. --
-
-
- Parameters:
dest- array to hold valuesoff- offset for arraylen- max number of bytes to read into array -- Returns:
- bytes read into array or -1 if end of stream is encountered. -
- Throws: -
java.io.IOException- Since: -
- 1.3 -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/Base64.OutputStream.html b/javadoc/org/owasp/esapi/codecs/Base64.OutputStream.html deleted file mode 100644 index eb81d9a07..000000000 --- a/javadoc/org/owasp/esapi/codecs/Base64.OutputStream.html +++ /dev/null @@ -1,463 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.codecs
-
-Class Base64.OutputStream
--java.lang.Object --
-
-
- Enclosing class:
- Base64 -
-
-
-
- public static class Base64.OutputStream
- extends java.io.FilterOutputStream
-A Base64.OutputStream will write data to another
- java.io.OutputStream, given in the constructor,
- and encode/decode to/from Base64 notation on the fly.
-
- -
-
-
-
- Since: -
- 1.3 -
- See Also:
Base64
- -
| -Constructor Summary | -|
Base64.OutputStream(java.io.OutputStream out)
-
-- Constructs a Base64.OutputStream in ENCODE mode. |
-|
Base64.OutputStream(java.io.OutputStream out,
- int options)
-
-- Constructs a Base64.OutputStream in
- either ENCODE or DECODE mode. |
-|
| -Method Summary | -|
- void |
-close()
-
-- Flushes and closes (I think, in the superclass) the stream. |
-
- void |
-flushBase64()
-
-- Method added by PHIL. |
-
- void |
-resumeEncoding()
-
-- Resumes encoding of the stream. |
-
- void |
-suspendEncoding()
-
-- Suspends encoding of the stream. |
-
- void |
-write(byte[] theBytes,
- int off,
- int len)
-
-- Calls write(int) repeatedly until len
- bytes are written. |
-
- void |
-write(int theByte)
-
-- Writes the byte to the output stream after - converting to/from Base64 notation. |
-
| Methods inherited from class java.io.FilterOutputStream | -
flush, write |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-Base64.OutputStream
--public Base64.OutputStream(java.io.OutputStream out)-
-
-
- Constructs a
Base64.OutputStreamin ENCODE mode. --
- Parameters:
out- the java.io.OutputStream to which data will be written.- Since: -
- 1.3 -
- -
-Base64.OutputStream
--public Base64.OutputStream(java.io.OutputStream out, - int options)-
-
-
- Constructs a
Base64.OutputStreamin - either ENCODE or DECODE mode. -- Valid options:
- ENCODE or DECODE: Encode or Decode as data is read. - DONT_BREAK_LINES: don't break lines at 76 characters - (only meaningful when encoding) - Note: Technically, this makes your encoding non-compliant. -
-- Example:
new Base64.OutputStream( out, Base64.ENCODE )--
- Parameters:
out- the java.io.OutputStream to which data will be written.options- Specified options.- Since: -
- 1.3 -
- See Also:
Base64.ENCODE, -Base64.DECODE, -Base64.DONT_BREAK_LINES
| -Method Detail | -
-write
--public void write(int theByte) - throws java.io.IOException-
-
-
- Writes the byte to the output stream after
- converting to/from Base64 notation.
- When encoding, bytes are buffered three
- at a time before the output stream actually
- gets a write() call.
- When decoding, bytes are buffered four
- at a time.
-
-
-
-
- Parameters:
theByte- the byte to write -- Throws: -
java.io.IOException- Since: -
- 1.3 -
- -
-write
--public void write(byte[] theBytes, - int off, - int len) - throws java.io.IOException-
-
-
- Calls
write(int)repeatedly until len - bytes are written. --
-
-
- Parameters:
theBytes- array from which to read bytesoff- offset for arraylen- max number of bytes to read into array -- Throws: -
java.io.IOException- Since: -
- 1.3 -
- -
-flushBase64
--public void flushBase64() - throws java.io.IOException-
-
-
- Method added by PHIL. [Thanks, PHIL. -Rob]
- This pads the buffer without closing the stream.
-
-
-
-
-
- Throws: -
java.io.IOException
- -
-close
--public void close() - throws java.io.IOException-
-
-
- Flushes and closes (I think, in the superclass) the stream.
-
-
-
-
-
- Throws: -
java.io.IOException- Since: -
- 1.3 -
- -
-suspendEncoding
--public void suspendEncoding() - throws java.io.IOException-
-
-
- Suspends encoding of the stream.
- May be helpful if you need to embed a piece of
- base640-encoded data in a stream.
-
-
-
-
-
- Throws: -
java.io.IOException- Since: -
- 1.5.1 -
- -
-resumeEncoding
--public void resumeEncoding()-
-
-
- Resumes encoding of the stream.
- May be helpful if you need to embed a piece of
- base640-encoded data in a stream.
-
-
-
-
- Since: -
- 1.5.1 -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/Base64.html b/javadoc/org/owasp/esapi/codecs/Base64.html deleted file mode 100644 index e30611b06..000000000 --- a/javadoc/org/owasp/esapi/codecs/Base64.html +++ /dev/null @@ -1,974 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.codecs
-
-Class Base64
--java.lang.Object --
-
-
-
- public class Base64
- extends java.lang.Object
-
Encodes and decodes to and from Base64 notation.
-Homepage: http://iharder.net/base64.
- -The options parameter, which appears in a few places, is used to pass - several pieces of information to the encoder. In the "higher level" methods such as - encodeBytes( bytes, options ) the options parameter can be used to indicate such - things as first gzipping the bytes before encoding them, not inserting linefeeds - (though that breaks strict Base64 compatibility), and encoding using the URL-safe - and Ordered dialects.
- -The constants defined in Base64 can be OR-ed together to combine options, so you - might make a call like this:
- -String encoded = Base64.encodeBytes( mybytes, Base64.GZIP | Base64.DONT_BREAK_LINES );
-
- to compress the data before encoding it and then making the output have no newline characters.
- - -- Change Log: -
--
-
- v2.2.2 - Fixed encodeFileToFile and decodeFileToFile to use the - Base64.InputStream class to encode and decode on the fly which uses - less memory than encoding/decoding an entire file into memory before writing. -
- v2.2.1 - Fixed bug using URL_SAFE and ORDERED encodings. Fixed bug - when using very small files (~< 40 bytes). -
- v2.2 - Added some helper methods for encoding/decoding directly from
- one file to the next. Also added a main() method to support command line
- encoding/decoding from one file to the next. Also added these Base64 dialects:
-
-
-
- The default is RFC3548 format. -
- Calling Base64.setFormat(Base64.BASE64_FORMAT.URLSAFE_FORMAT) generates - URL and file name friendly format as described in Section 4 of RFC3548. - http://www.faqs.org/rfcs/rfc3548.html -
- Calling Base64.setFormat(Base64.BASE64_FORMAT.ORDERED_FORMAT) generates - URL and file name friendly format that preserves lexical ordering as described - in http://www.faqs.org/qa/rfcc-1940.html -
-
- - v2.1 - Cleaned up javadoc comments and unused variables and methods. Added - some convenience methods for reading and writing to and from files. -
- v2.0.2 - Now specifies UTF-8 encoding in places where the code fails on systems - with other encodings (like EBCDIC). -
- v2.0.1 - Fixed an error when decoding a single byte, that is, when the - encoded data was a single byte. -
- v2.0 - I got rid of methods that used booleans to set options. - Now everything is more consolidated and cleaner. The code now detects - when data that's being decoded is gzip-compressed and will decompress it - automatically. Generally things are cleaner. You'll probably have to - change some method calls that you were making to support the new - options format (ints that you "OR" together). -
- v1.5.1 - Fixed bug when decompressing and decoding to a - byte[] using decode( String s, boolean gzipCompressed ). - Added the ability to "suspend" encoding in the Output Stream so - you can turn on and off the encoding if you need to embed base64 - data in an otherwise "normal" stream (like an XML file). -
- v1.5 - Output stream pases on flush() command but doesn't do anything itself. - This helps when using GZIP streams. - Added the ability to GZip-compress objects before encoding them. -
- v1.4 - Added helper methods to read/write files. -
- v1.3.6 - Fixed OutputStream.flush() so that 'position' is reset. -
- v1.3.5 - Added flag to turn on and off line breaks. Fixed bug in input stream - where last buffer being read, if not completely full, was not returned. -
- v1.3.4 - Fixed when "improperly padded stream" error was thrown at the wrong time. -
- v1.3.3 - Fixed I/O streams which were totally messed up. -
- I am placing this code in the Public Domain. Do with it as you will. - This software comes with no guarantees or warranties but with - plenty of well-wishing instead! - Please visit http://iharder.net/base64 - periodically to check for updates or to contribute improvements. -
-- -
-
-
-
- Version: -
- 2.2.2 -
- Author: -
- Robert Harder, rob@iharder.net -
- -
| -Nested Class Summary | -|
-static class |
-Base64.InputStream
-
-- A Base64.InputStream will read data from another
- java.io.InputStream, given in the constructor,
- and encode/decode to/from Base64 notation on the fly. |
-
-static class |
-Base64.OutputStream
-
-- A Base64.OutputStream will write data to another
- java.io.OutputStream, given in the constructor,
- and encode/decode to/from Base64 notation on the fly. |
-
| -Field Summary | -|
-static int |
-DECODE
-
-- Specify decoding. |
-
-static int |
-DONT_BREAK_LINES
-
-- Don't break lines when encoding (violates strict Base64 specification) |
-
-static int |
-ENCODE
-
-- Specify encoding. |
-
-static int |
-GZIP
-
-- Specify that data should be gzip-compressed. |
-
-static int |
-NO_OPTIONS
-
-- No options specified. |
-
-static int |
-ORDERED
-
-- Encode using the special "ordered" dialect of Base64 described here: - http://www.faqs.org/qa/rfcc-1940.html. |
-
-static int |
-URL_SAFE
-
-- Encode using Base64-like encoding that is URL- and Filename-safe as described - in Section 4 of RFC3548: - http://www.faqs.org/rfcs/rfc3548.html. |
-
| -Method Summary | -|
-static byte[] |
-decode(byte[] source,
- int off,
- int len,
- int options)
-
-- Very low-level access to decoding ASCII characters in - the form of a byte array. |
-
-static byte[] |
-decode(java.lang.String s)
-
-- Decodes data from Base64 notation, automatically - detecting gzip-compressed data and decompressing it. |
-
-static byte[] |
-decode(java.lang.String s,
- int options)
-
-- Decodes data from Base64 notation, automatically - detecting gzip-compressed data and decompressing it. |
-
-static boolean |
-decodeFileToFile(java.lang.String infile,
- java.lang.String outfile)
-
-- Reads infile and decodes it to outfile. |
-
-static byte[] |
-decodeFromFile(java.lang.String filename)
-
-- Convenience method for reading a base64-encoded - file and decoding it. |
-
-static boolean |
-decodeToFile(java.lang.String dataToDecode,
- java.lang.String filename)
-
-- Convenience method for decoding data to a file. |
-
-static java.lang.Object |
-decodeToObject(java.lang.String encodedObject)
-
-- Attempts to decode Base64 data and deserialize a Java - Object within. |
-
-static java.lang.String |
-encodeBytes(byte[] source)
-
-- Encodes a byte array into Base64 notation. |
-
-static java.lang.String |
-encodeBytes(byte[] source,
- int options)
-
-- Encodes a byte array into Base64 notation. |
-
-static java.lang.String |
-encodeBytes(byte[] source,
- int off,
- int len)
-
-- Encodes a byte array into Base64 notation. |
-
-static java.lang.String |
-encodeBytes(byte[] source,
- int off,
- int len,
- int options)
-
-- Encodes a byte array into Base64 notation. |
-
-static boolean |
-encodeFileToFile(java.lang.String infile,
- java.lang.String outfile)
-
-- Reads infile and encodes it to outfile. |
-
-static java.lang.String |
-encodeFromFile(java.lang.String filename)
-
-- Convenience method for reading a binary file - and base64-encoding it. |
-
-static java.lang.String |
-encodeObject(java.io.Serializable serializableObject)
-
-- Serializes an object and returns the Base64-encoded - version of that serialized object. |
-
-static java.lang.String |
-encodeObject(java.io.Serializable serializableObject,
- int options)
-
-- Serializes an object and returns the Base64-encoded - version of that serialized object. |
-
-static boolean |
-encodeToFile(byte[] dataToEncode,
- java.lang.String filename)
-
-- Convenience method for encoding data to a file. |
-
-static void |
-main(java.lang.String[] args)
-
-- Encodes or decodes two files from the command line; - feel free to delete this method (in fact you probably should) - if you're embedding this code into a larger program. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Field Detail | -
-NO_OPTIONS
--public static final int NO_OPTIONS-
-
-
- No options specified. Value is zero.
-
-
-
-
- See Also:
- Constant Field Values
- -
-ENCODE
--public static final int ENCODE-
-
-
- Specify encoding.
-
-
-
-
- See Also:
- Constant Field Values
- -
-DECODE
--public static final int DECODE-
-
-
- Specify decoding.
-
-
-
-
- See Also:
- Constant Field Values
- -
-GZIP
--public static final int GZIP-
-
-
- Specify that data should be gzip-compressed.
-
-
-
-
- See Also:
- Constant Field Values
- -
-DONT_BREAK_LINES
--public static final int DONT_BREAK_LINES-
-
-
- Don't break lines when encoding (violates strict Base64 specification)
-
-
-
-
- See Also:
- Constant Field Values
- -
-URL_SAFE
--public static final int URL_SAFE-
-
-
- Encode using Base64-like encoding that is URL- and Filename-safe as described
- in Section 4 of RFC3548:
- http://www.faqs.org/rfcs/rfc3548.html.
- It is important to note that data encoded this way is not officially valid Base64,
- or at the very least should not be called Base64 without also specifying that is
- was encoded using the URL- and Filename-safe dialect.
-
-
-
-
- See Also:
- Constant Field Values
- -
-ORDERED
--public static final int ORDERED-
-
-
- Encode using the special "ordered" dialect of Base64 described here:
- http://www.faqs.org/qa/rfcc-1940.html.
-
-
-
-
- See Also:
- Constant Field Values
| -Method Detail | -
-main
--public static final void main(java.lang.String[] args)-
-
-
- Encodes or decodes two files from the command line;
- feel free to delete this method (in fact you probably should)
- if you're embedding this code into a larger program.
-
-
-
-
- -
-encodeObject
--public static java.lang.String encodeObject(java.io.Serializable serializableObject)-
-
-
- Serializes an object and returns the Base64-encoded
- version of that serialized object. If the object
- cannot be serialized or there is another error,
- the method will return null.
- The object is not GZip-compressed before being encoded.
-
-
-
-
- Parameters:
serializableObject- The object to encode -- Returns:
- The Base64-encoded object
- Since: -
- 1.4 -
- -
-encodeObject
--public static java.lang.String encodeObject(java.io.Serializable serializableObject, - int options)-
-
-
- Serializes an object and returns the Base64-encoded
- version of that serialized object. If the object
- cannot be serialized or there is another error,
- the method will return null.
-
- Valid options:
- GZIP: gzip-compresses object before encoding it. - DONT_BREAK_LINES: don't break lines at 76 characters - Note: Technically, this makes your encoding non-compliant. -
-- Example:
encodeObject( myObj, Base64.GZIP )or -- Example:
encodeObject( myObj, Base64.GZIP | Base64.DONT_BREAK_LINES )--
-
-
- Parameters:
serializableObject- The object to encodeoptions- Specified options -- Returns:
- The Base64-encoded object
- Since: -
- 2.0 -
- See Also:
GZIP, -DONT_BREAK_LINES
- -
-encodeBytes
--public static java.lang.String encodeBytes(byte[] source)-
-
-
- Encodes a byte array into Base64 notation.
- Does not GZip-compress data.
-
-
-
-
- Parameters:
source- The data to convert- Since: -
- 1.4 -
- -
-encodeBytes
--public static java.lang.String encodeBytes(byte[] source, - int options)-
-
-
- Encodes a byte array into Base64 notation.
-
- Valid options:
- GZIP: gzip-compresses object before encoding it. - DONT_BREAK_LINES: don't break lines at 76 characters - Note: Technically, this makes your encoding non-compliant. -
-- Example:
encodeBytes( myData, Base64.GZIP )or -- Example:
encodeBytes( myData, Base64.GZIP | Base64.DONT_BREAK_LINES )--
-
-
- Parameters:
source- The data to convertoptions- Specified options- Since: -
- 2.0 -
- See Also:
GZIP, -DONT_BREAK_LINES
- -
-encodeBytes
--public static java.lang.String encodeBytes(byte[] source, - int off, - int len)-
-
-
- Encodes a byte array into Base64 notation.
- Does not GZip-compress data.
-
-
-
-
- Parameters:
source- The data to convertoff- Offset in array where conversion should beginlen- Length of data to convert- Since: -
- 1.4 -
- -
-encodeBytes
--public static java.lang.String encodeBytes(byte[] source, - int off, - int len, - int options)-
-
-
- Encodes a byte array into Base64 notation.
-
- Valid options:
- GZIP: gzip-compresses object before encoding it. - DONT_BREAK_LINES: don't break lines at 76 characters - Note: Technically, this makes your encoding non-compliant. -
-- Example:
encodeBytes( myData, Base64.GZIP )or -- Example:
encodeBytes( myData, Base64.GZIP | Base64.DONT_BREAK_LINES )--
-
-
- Parameters:
source- The data to convertoff- Offset in array where conversion should beginlen- Length of data to convertoptions- Specified options- Since: -
- 2.0 -
- See Also:
GZIP, -DONT_BREAK_LINES
- -
-decode
--public static byte[] decode(byte[] source, - int off, - int len, - int options)-
-
-
- Very low-level access to decoding ASCII characters in
- the form of a byte array. Does not support automatically
- gunzipping or any other "fancy" features.
-
-
-
-
- Parameters:
source- The Base64 encoded dataoff- The offset of where to begin decodinglen- The length of characters to decode -- Returns:
- decoded data
- Since: -
- 1.3 -
- -
-decode
--public static byte[] decode(java.lang.String s)-
-
-
- Decodes data from Base64 notation, automatically
- detecting gzip-compressed data and decompressing it.
-
-
-
-
- Parameters:
s- the string to decode -- Returns:
- the decoded data
- Since: -
- 1.4 -
- -
-decode
--public static byte[] decode(java.lang.String s, - int options)-
-
-
- Decodes data from Base64 notation, automatically
- detecting gzip-compressed data and decompressing it.
-
-
-
-
- Parameters:
s- the string to decodeoptions- encode options such as URL_SAFE -- Returns:
- the decoded data
- Since: -
- 1.4 -
- -
-decodeToObject
--public static java.lang.Object decodeToObject(java.lang.String encodedObject)-
-
-
- Attempts to decode Base64 data and deserialize a Java
- Object within. Returns null if there was an error.
-
-
-
-
- Parameters:
encodedObject- The Base64 data to decode -- Returns:
- The decoded and deserialized object
- Since: -
- 1.5 -
- -
-encodeToFile
--public static boolean encodeToFile(byte[] dataToEncode, - java.lang.String filename)-
-
-
- Convenience method for encoding data to a file.
-
-
-
-
- Parameters:
dataToEncode- byte array of data to encode in base64 formfilename- Filename for saving encoded data -- Returns:
- true if successful, false otherwise
- Since: -
- 2.1 -
- -
-decodeToFile
--public static boolean decodeToFile(java.lang.String dataToDecode, - java.lang.String filename)-
-
-
- Convenience method for decoding data to a file.
-
-
-
-
- Parameters:
dataToDecode- Base64-encoded data as a stringfilename- Filename for saving decoded data -- Returns:
- true if successful, false otherwise
- Since: -
- 2.1 -
- -
-decodeFromFile
--public static byte[] decodeFromFile(java.lang.String filename)-
-
-
- Convenience method for reading a base64-encoded
- file and decoding it.
-
-
-
-
- Parameters:
filename- Filename for reading encoded data -- Returns:
- decoded byte array or null if unsuccessful
- Since: -
- 2.1 -
- -
-encodeFromFile
--public static java.lang.String encodeFromFile(java.lang.String filename)-
-
-
- Convenience method for reading a binary file
- and base64-encoding it.
-
-
-
-
- Parameters:
filename- Filename for reading binary data -- Returns:
- base64-encoded string or null if unsuccessful
- Since: -
- 2.1 -
- -
-encodeFileToFile
--public static boolean encodeFileToFile(java.lang.String infile, - java.lang.String outfile)-
-
-
- Reads infile and encodes it to outfile.
-
-
-
-
- Parameters:
infile- Input fileoutfile- Output file -- Returns:
- true if the operation is successful
- Since: -
- 2.2 -
- -
-decodeFileToFile
--public static boolean decodeFileToFile(java.lang.String infile, - java.lang.String outfile)-
-
-
- Reads infile and decodes it to outfile.
-
-
-
-
- Parameters:
infile- Input fileoutfile- Output file -- Returns:
- true if the operation is successful
- Since: -
- 2.2 -
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/CSSCodec.html b/javadoc/org/owasp/esapi/codecs/CSSCodec.html deleted file mode 100644 index 64fc0a666..000000000 --- a/javadoc/org/owasp/esapi/codecs/CSSCodec.html +++ /dev/null @@ -1,346 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.codecs
-
-Class CSSCodec
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Codec -
-
-
-
- public class CSSCodec
- extends java.lang.Object
- implements Codec
- extends java.lang.Object
-Implementation of the Codec interface for backslash encoding frequently used in JavaScript. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Encoder
- -
| -Constructor Summary | -|
CSSCodec()
-
-- |
-|
| -Method Summary | -|
- java.lang.String |
-decode(java.lang.String input)
-
-- |
-
- java.lang.Character |
-decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.String |
-encode(java.lang.String input)
-
-- |
-
- java.lang.String |
-encodeCharacter(java.lang.Character c)
-
-- Returns backslash encoded character. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-CSSCodec
--public CSSCodec()-
-
-
| -Method Detail | -
-encode
--public java.lang.String encode(java.lang.String input)- -
- -
-encodeCharacter
--public java.lang.String encodeCharacter(java.lang.Character c)-
-
-
- Returns backslash encoded character. This implementation does not support
- \\### Latin encoded characters in octal as it is not in ECMAScript v3.
-
-
-
-
- Specified by:
encodeCharacterin interfaceCodec
-
-
- -
-decode
--public java.lang.String decode(java.lang.String input)- -
- -
-decodeCharacter
--public java.lang.Character decodeCharacter(PushbackString input)-
-
-
- Returns the decoded version of the character starting at index, or
- null if no decoding is possible.
-
- Formats all are legal both upper/lower case:
- \\x - special characters
- \\HHHH
-
-
-
-
- Specified by:
decodeCharacterin interfaceCodec
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/Codec.html b/javadoc/org/owasp/esapi/codecs/Codec.html deleted file mode 100644 index 48033c85a..000000000 --- a/javadoc/org/owasp/esapi/codecs/Codec.html +++ /dev/null @@ -1,292 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.codecs
-
-Interface Codec
--
-
- All Known Implementing Classes:
- CSSCodec, HTMLEntityCodec, JavaScriptCodec, MySQLCodec, OracleCodec, PercentCodec, VBScriptCodec -
-
-
-
- public interface Codec
-The Codec interface defines a set of methods for encoding and decoding application level encoding schemes, - such as HTML entity encoding and percent encoding (aka URL encoding). Codecs are used in output encoding - and canonicalization. The design of these codecs allows for character-by-character decoding, which is - necessary to detect double-encoding and the use of multiple encoding schemes, both of which are techniques - used by attackers to bypass validation and bury encoded attacks in data. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Encoder
- -
| -Method Summary | -|
- java.lang.String |
-decode(java.lang.String input)
-
-- |
-
- java.lang.Character |
-decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the next character from the input string and advances the - current character in the PushbackString. |
-
- java.lang.String |
-encode(java.lang.String input)
-
-- |
-
- java.lang.String |
-encodeCharacter(java.lang.Character c)
-
-- |
-
| -Method Detail | -
-encode
--public java.lang.String encode(java.lang.String input)-
-
-
-
-
-
- -
-encodeCharacter
--public java.lang.String encodeCharacter(java.lang.Character c)-
-
-
-
-
-
- -
-decode
--public java.lang.String decode(java.lang.String input)-
-
-
-
-
-
- -
-decodeCharacter
--public java.lang.Character decodeCharacter(PushbackString input)-
-
-
- Returns the decoded version of the next character from the input string and advances the
- current character in the PushbackString. If the current character is not encoded, this
- method MUST reset the PushbackString.
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/HTMLEntityCodec.html b/javadoc/org/owasp/esapi/codecs/HTMLEntityCodec.html deleted file mode 100644 index 36258ae43..000000000 --- a/javadoc/org/owasp/esapi/codecs/HTMLEntityCodec.html +++ /dev/null @@ -1,366 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.codecs
-
-Class HTMLEntityCodec
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Codec -
-
-
-
- public class HTMLEntityCodec
- extends java.lang.Object
- implements Codec
- extends java.lang.Object
-Implementation of the Codec interface for HTML entity encoding. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Encoder
- -
| -Constructor Summary | -|
HTMLEntityCodec()
-
-- |
-|
| -Method Summary | -|
- java.lang.String |
-decode(java.lang.String input)
-
-- |
-
- java.lang.Character |
-decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.String |
-encode(java.lang.String input)
-
-- |
-
- java.lang.String |
-encodeCharacter(java.lang.Character c)
-
-- |
-
-static void |
-main(java.lang.String[] args)
-
-- |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-HTMLEntityCodec
--public HTMLEntityCodec()-
-
-
| -Method Detail | -
-encode
--public java.lang.String encode(java.lang.String input)- -
- -
-encodeCharacter
--public java.lang.String encodeCharacter(java.lang.Character c)-
-
-
-
-
- Specified by:
encodeCharacterin interfaceCodec
--
-
-
- -
-decode
--public java.lang.String decode(java.lang.String input)- -
- -
-decodeCharacter
--public java.lang.Character decodeCharacter(PushbackString input)-
-
-
- Returns the decoded version of the character starting at index, or
- null if no decoding is possible.
-
- Formats all are legal both with and without semi-colon, upper/lower case:
- &#dddd;
- &#xhhhh;
- &name;
-
-
-
-
- Specified by:
decodeCharacterin interfaceCodec
-
-
- -
-main
--public static void main(java.lang.String[] args)-
-
-
-
-
--
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/JavaScriptCodec.html b/javadoc/org/owasp/esapi/codecs/JavaScriptCodec.html deleted file mode 100644 index 441919aa0..000000000 --- a/javadoc/org/owasp/esapi/codecs/JavaScriptCodec.html +++ /dev/null @@ -1,347 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.codecs
-
-Class JavaScriptCodec
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Codec -
-
-
-
- public class JavaScriptCodec
- extends java.lang.Object
- implements Codec
- extends java.lang.Object
-Implementation of the Codec interface for backslash encoding frequently used in JavaScript. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Encoder
- -
| -Constructor Summary | -|
JavaScriptCodec()
-
-- |
-|
| -Method Summary | -|
- java.lang.String |
-decode(java.lang.String input)
-
-- |
-
- java.lang.Character |
-decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.String |
-encode(java.lang.String input)
-
-- |
-
- java.lang.String |
-encodeCharacter(java.lang.Character c)
-
-- Returns backslash encoded character. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-JavaScriptCodec
--public JavaScriptCodec()-
-
-
| -Method Detail | -
-encode
--public java.lang.String encode(java.lang.String input)- -
- -
-encodeCharacter
--public java.lang.String encodeCharacter(java.lang.Character c)-
-
-
- Returns backslash encoded character. This implementation does not support
- \\### Latin encoded characters in octal as it is not in ECMAScript v3.
-
-
-
-
- Specified by:
encodeCharacterin interfaceCodec
-
-
- -
-decode
--public java.lang.String decode(java.lang.String input)- -
- -
-decodeCharacter
--public java.lang.Character decodeCharacter(PushbackString input)-
-
-
- Returns the decoded version of the character starting at index, or
- null if no decoding is possible.
-
- Formats all are legal both upper/lower case:
- \\a - special characters
- \\xHH
- \\uHHHH
-
-
-
-
- Specified by:
decodeCharacterin interfaceCodec
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/MySQLCodec.html b/javadoc/org/owasp/esapi/codecs/MySQLCodec.html deleted file mode 100644 index 743a3f5de..000000000 --- a/javadoc/org/owasp/esapi/codecs/MySQLCodec.html +++ /dev/null @@ -1,395 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.codecs
-
-Class MySQLCodec
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Codec -
-
-
-
- public class MySQLCodec
- extends java.lang.Object
- implements Codec
- extends java.lang.Object
-Implementation of the Codec interface for MySQL strings. See http://mirror.yandex.ru/mirrors/ftp.mysql.com/doc/refman/5.0/en/string-syntax.html - for more information. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Encoder
- -
| -Field Summary | -|
-static int |
-ANSI_MODE
-
-- |
-
-static int |
-MYSQL_MODE
-
-- |
-
| -Constructor Summary | -|
MySQLCodec(int mode)
-
-- |
-|
| -Method Summary | -|
- java.lang.String |
-decode(java.lang.String input)
-
-- |
-
- java.lang.Character |
-decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.String |
-encode(java.lang.String input)
-
-- |
-
- java.lang.String |
-encodeCharacter(java.lang.Character c)
-
-- Returns quote-encoded character |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Field Detail | -
-MYSQL_MODE
--public static final int MYSQL_MODE-
-
-
- See Also:
- Constant Field Values
-
-
- -
-ANSI_MODE
--public static final int ANSI_MODE-
-
-
- See Also:
- Constant Field Values
-
-
| -Constructor Detail | -
-MySQLCodec
--public MySQLCodec(int mode)-
-
-
| -Method Detail | -
-encode
--public java.lang.String encode(java.lang.String input)- -
- -
-encodeCharacter
--public java.lang.String encodeCharacter(java.lang.Character c)-
-
-
- Returns quote-encoded character
-
-
-
-
- Specified by:
encodeCharacterin interfaceCodec
-
-
- -
-decode
--public java.lang.String decode(java.lang.String input)- -
- -
-decodeCharacter
--public java.lang.Character decodeCharacter(PushbackString input)-
-
-
- Returns the decoded version of the character starting at index, or
- null if no decoding is possible.
-
- Formats all are legal (case sensitive)
- In ANSI_MODE '' decodes to '
- In MYSQL_MODE \x decodes to x (or a small list of specials)
-
-
-
-
- Specified by:
decodeCharacterin interfaceCodec
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/OracleCodec.html b/javadoc/org/owasp/esapi/codecs/OracleCodec.html deleted file mode 100644 index b8e9eafcb..000000000 --- a/javadoc/org/owasp/esapi/codecs/OracleCodec.html +++ /dev/null @@ -1,345 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.codecs
-
-Class OracleCodec
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Codec -
-
-
-
- public class OracleCodec
- extends java.lang.Object
- implements Codec
- extends java.lang.Object
-Implementation of the Codec interface for Oracle strings. See http://download-uk.oracle.com/docs/cd/B10501_01/text.920/a96518/cqspcl.htm - for more information. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Encoder
- -
| -Constructor Summary | -|
OracleCodec()
-
-- |
-|
| -Method Summary | -|
- java.lang.String |
-decode(java.lang.String input)
-
-- |
-
- java.lang.Character |
-decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.String |
-encode(java.lang.String input)
-
-- |
-
- java.lang.String |
-encodeCharacter(java.lang.Character c)
-
-- Returns quote-encoded character |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-OracleCodec
--public OracleCodec()-
-
-
| -Method Detail | -
-encode
--public java.lang.String encode(java.lang.String input)- -
- -
-encodeCharacter
--public java.lang.String encodeCharacter(java.lang.Character c)-
-
-
- Returns quote-encoded character
-
-
-
-
- Specified by:
encodeCharacterin interfaceCodec
-
-
- -
-decode
--public java.lang.String decode(java.lang.String input)- -
- -
-decodeCharacter
--public java.lang.Character decodeCharacter(PushbackString input)-
-
-
- Returns the decoded version of the character starting at index, or
- null if no decoding is possible.
-
- Formats all are legal
- \c decodes to c
-
-
-
-
- Specified by:
decodeCharacterin interfaceCodec
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/PercentCodec.html b/javadoc/org/owasp/esapi/codecs/PercentCodec.html deleted file mode 100644 index 515df03f0..000000000 --- a/javadoc/org/owasp/esapi/codecs/PercentCodec.html +++ /dev/null @@ -1,342 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.codecs
-
-Class PercentCodec
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Codec -
-
-
-
- public class PercentCodec
- extends java.lang.Object
- implements Codec
- extends java.lang.Object
-Implementation of the Codec interface for percent encoding (aka URL encoding). -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Encoder
- -
| -Constructor Summary | -|
PercentCodec()
-
-- |
-|
| -Method Summary | -|
- java.lang.String |
-decode(java.lang.String input)
-
-- |
-
- java.lang.Character |
-decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.String |
-encode(java.lang.String input)
-
-- |
-
- java.lang.String |
-encodeCharacter(java.lang.Character c)
-
-- |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-PercentCodec
--public PercentCodec()-
-
-
| -Method Detail | -
-encode
--public java.lang.String encode(java.lang.String input)- -
- -
-encodeCharacter
--public java.lang.String encodeCharacter(java.lang.Character c)-
-
-
-
-
- Specified by:
encodeCharacterin interfaceCodec
--
-
-
- -
-decode
--public java.lang.String decode(java.lang.String input)- -
- -
-decodeCharacter
--public java.lang.Character decodeCharacter(PushbackString input)-
-
-
- Returns the decoded version of the character starting at index, or
- null if no decoding is possible.
-
- Formats all are legal both upper/lower case:
- %hh;
-
-
-
-
- Specified by:
decodeCharacterin interfaceCodec
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/PushbackString.html b/javadoc/org/owasp/esapi/codecs/PushbackString.html deleted file mode 100644 index 16e532206..000000000 --- a/javadoc/org/owasp/esapi/codecs/PushbackString.html +++ /dev/null @@ -1,454 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.codecs
-
-Class PushbackString
--java.lang.Object --
-
-
-
- public class PushbackString
- extends java.lang.Object
-The pushback string is used by Codecs to allow them to push decoded characters back onto a string - for further decoding. This is necessary to detect double-encoding. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Encoder
- -
| -Constructor Summary | -|
PushbackString(java.lang.String input)
-
-- |
-|
| -Method Summary | -|
- boolean |
-hasNext()
-
-- |
-
- int |
-index()
-
-- |
-
- boolean |
-isHexDigit(java.lang.Character c)
-
-- |
-
- boolean |
-isPushback()
-
-- |
-
- void |
-mark()
-
-- |
-
- java.lang.Character |
-next()
-
-- |
-
- java.lang.Character |
-nextHex()
-
-- |
-
- java.lang.Character |
-peek()
-
-- |
-
- boolean |
-peek(char c)
-
-- |
-
- void |
-pushback(java.lang.Character c)
-
-- |
-
- void |
-reset()
-
-- |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-PushbackString
--public PushbackString(java.lang.String input)-
-
-
| -Method Detail | -
-pushback
--public void pushback(java.lang.Character c)-
-
-
-
-
-
- -
-index
--public int index()-
-
-
-
-
-
- -
-hasNext
--public boolean hasNext()-
-
-
-
-
-
- -
-next
--public java.lang.Character next()-
-
-
-
-
-
- -
-nextHex
--public java.lang.Character nextHex()-
-
-
-
-
-
- -
-isHexDigit
--public boolean isHexDigit(java.lang.Character c)-
-
-
-
-
-
- -
-peek
--public java.lang.Character peek()-
-
-
-
-
-
- -
-peek
--public boolean peek(char c)-
-
-
-
-
-
- -
-isPushback
--public boolean isPushback()-
-
-
-
-
-
- -
-mark
--public void mark()-
-
-
-
-
-
- -
-reset
--public void reset()-
-
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/VBScriptCodec.html b/javadoc/org/owasp/esapi/codecs/VBScriptCodec.html deleted file mode 100644 index e986a18a1..000000000 --- a/javadoc/org/owasp/esapi/codecs/VBScriptCodec.html +++ /dev/null @@ -1,345 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.codecs
-
-Class VBScriptCodec
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Codec -
-
-
-
- public class VBScriptCodec
- extends java.lang.Object
- implements Codec
- extends java.lang.Object
-Implementation of the Codec interface for 'quote' encoding from VBScript. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Encoder
- -
| -Constructor Summary | -|
VBScriptCodec()
-
-- |
-|
| -Method Summary | -|
- java.lang.String |
-decode(java.lang.String input)
-
-- |
-
- java.lang.Character |
-decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.String |
-encode(java.lang.String input)
-
-- |
-
- java.lang.String |
-encodeCharacter(java.lang.Character c)
-
-- Returns quote-encoded character |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-VBScriptCodec
--public VBScriptCodec()-
-
-
| -Method Detail | -
-encode
--public java.lang.String encode(java.lang.String input)- -
- -
-encodeCharacter
--public java.lang.String encodeCharacter(java.lang.Character c)-
-
-
- Returns quote-encoded character
-
-
-
-
- Specified by:
encodeCharacterin interfaceCodec
-
-
- -
-decode
--public java.lang.String decode(java.lang.String input)- -
- -
-decodeCharacter
--public java.lang.Character decodeCharacter(PushbackString input)-
-
-
- Returns the decoded version of the character starting at index, or
- null if no decoding is possible.
-
- Formats all are legal both upper/lower case:
- "x - all special characters
- " + chr(x) + " - not supported yet
-
-
-
-
- Specified by:
decodeCharacterin interfaceCodec
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/class-use/Base64.InputStream.html b/javadoc/org/owasp/esapi/codecs/class-use/Base64.InputStream.html deleted file mode 100644 index a67afc976..000000000 --- a/javadoc/org/owasp/esapi/codecs/class-use/Base64.InputStream.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.codecs.Base64.InputStream
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/class-use/Base64.OutputStream.html b/javadoc/org/owasp/esapi/codecs/class-use/Base64.OutputStream.html deleted file mode 100644 index f054a0476..000000000 --- a/javadoc/org/owasp/esapi/codecs/class-use/Base64.OutputStream.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.codecs.Base64.OutputStream
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/class-use/Base64.html b/javadoc/org/owasp/esapi/codecs/class-use/Base64.html deleted file mode 100644 index f6bb41ce8..000000000 --- a/javadoc/org/owasp/esapi/codecs/class-use/Base64.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.codecs.Base64
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/class-use/CSSCodec.html b/javadoc/org/owasp/esapi/codecs/class-use/CSSCodec.html deleted file mode 100644 index 6405a0f44..000000000 --- a/javadoc/org/owasp/esapi/codecs/class-use/CSSCodec.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.codecs.CSSCodec
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/class-use/Codec.html b/javadoc/org/owasp/esapi/codecs/class-use/Codec.html deleted file mode 100644 index e452c9d86..000000000 --- a/javadoc/org/owasp/esapi/codecs/class-use/Codec.html +++ /dev/null @@ -1,281 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.codecs.Codec
-| -Packages that use Codec | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.codecs | -- |
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of Codec in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi with parameters of type Codec | -|
- java.lang.String |
-Encoder.encodeForSQL(Codec codec,
- java.lang.String input)
-
-- Encode for SQL according to the selected codec. |
-
| -Uses of Codec in org.owasp.esapi.codecs | -
- -
| Classes in org.owasp.esapi.codecs that implement Codec | -|
- class |
-CSSCodec
-
-- Implementation of the Codec interface for backslash encoding frequently used in JavaScript. |
-
- class |
-HTMLEntityCodec
-
-- Implementation of the Codec interface for HTML entity encoding. |
-
- class |
-JavaScriptCodec
-
-- Implementation of the Codec interface for backslash encoding frequently used in JavaScript. |
-
- class |
-MySQLCodec
-
-- Implementation of the Codec interface for MySQL strings. |
-
- class |
-OracleCodec
-
-- Implementation of the Codec interface for Oracle strings. |
-
- class |
-PercentCodec
-
-- Implementation of the Codec interface for percent encoding (aka URL encoding). |
-
- class |
-VBScriptCodec
-
-- Implementation of the Codec interface for 'quote' encoding from VBScript. |
-
| -Uses of Codec in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference with parameters of type Codec | -|
- java.lang.String |
-DefaultEncoder.encodeForSQL(Codec codec,
- java.lang.String input)
-
-- This method is not recommended. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/class-use/HTMLEntityCodec.html b/javadoc/org/owasp/esapi/codecs/class-use/HTMLEntityCodec.html deleted file mode 100644 index a72c75b91..000000000 --- a/javadoc/org/owasp/esapi/codecs/class-use/HTMLEntityCodec.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.codecs.HTMLEntityCodec
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/class-use/JavaScriptCodec.html b/javadoc/org/owasp/esapi/codecs/class-use/JavaScriptCodec.html deleted file mode 100644 index a2d97dd73..000000000 --- a/javadoc/org/owasp/esapi/codecs/class-use/JavaScriptCodec.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.codecs.JavaScriptCodec
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/class-use/MySQLCodec.html b/javadoc/org/owasp/esapi/codecs/class-use/MySQLCodec.html deleted file mode 100644 index 5456786ee..000000000 --- a/javadoc/org/owasp/esapi/codecs/class-use/MySQLCodec.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.codecs.MySQLCodec
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/class-use/OracleCodec.html b/javadoc/org/owasp/esapi/codecs/class-use/OracleCodec.html deleted file mode 100644 index bce515042..000000000 --- a/javadoc/org/owasp/esapi/codecs/class-use/OracleCodec.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.codecs.OracleCodec
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/class-use/PercentCodec.html b/javadoc/org/owasp/esapi/codecs/class-use/PercentCodec.html deleted file mode 100644 index 3ed4aa7d6..000000000 --- a/javadoc/org/owasp/esapi/codecs/class-use/PercentCodec.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.codecs.PercentCodec
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/class-use/PushbackString.html b/javadoc/org/owasp/esapi/codecs/class-use/PushbackString.html deleted file mode 100644 index f354a9ac2..000000000 --- a/javadoc/org/owasp/esapi/codecs/class-use/PushbackString.html +++ /dev/null @@ -1,236 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.codecs.PushbackString
-| -Packages that use PushbackString | -|
| org.owasp.esapi.codecs | -- |
| -Uses of PushbackString in org.owasp.esapi.codecs | -
- -
| Methods in org.owasp.esapi.codecs with parameters of type PushbackString | -|
- java.lang.Character |
-VBScriptCodec.decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.Character |
-PercentCodec.decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.Character |
-OracleCodec.decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.Character |
-MySQLCodec.decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.Character |
-JavaScriptCodec.decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.Character |
-HTMLEntityCodec.decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.Character |
-CSSCodec.decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the character starting at index, or - null if no decoding is possible. |
-
- java.lang.Character |
-Codec.decodeCharacter(PushbackString input)
-
-- Returns the decoded version of the next character from the input string and advances the - current character in the PushbackString. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/class-use/VBScriptCodec.html b/javadoc/org/owasp/esapi/codecs/class-use/VBScriptCodec.html deleted file mode 100644 index 4357a494d..000000000 --- a/javadoc/org/owasp/esapi/codecs/class-use/VBScriptCodec.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.codecs.VBScriptCodec
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/package-frame.html b/javadoc/org/owasp/esapi/codecs/package-frame.html deleted file mode 100644 index dd930822f..000000000 --- a/javadoc/org/owasp/esapi/codecs/package-frame.html +++ /dev/null @@ -1,63 +0,0 @@ - - - - - -
|
-Interfaces
-
- -Codec |
-
|
-Classes
-
- -Base64 - -Base64.InputStream - -Base64.OutputStream - -CSSCodec - -HTMLEntityCodec - -JavaScriptCodec - -MySQLCodec - -OracleCodec - -PercentCodec - -PushbackString - -VBScriptCodec |
-
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Package org.owasp.esapi.codecs -
- -| -Interface Summary | -|
| Codec | -The Codec interface defines a set of methods for encoding and decoding application level encoding schemes, - such as HTML entity encoding and percent encoding (aka URL encoding). | -
- -
| -Class Summary | -|
| Base64 | -Encodes and decodes to and from Base64 notation. | -
| Base64.InputStream | -A Base64.InputStream will read data from another
- java.io.InputStream, given in the constructor,
- and encode/decode to/from Base64 notation on the fly. |
-
| Base64.OutputStream | -A Base64.OutputStream will write data to another
- java.io.OutputStream, given in the constructor,
- and encode/decode to/from Base64 notation on the fly. |
-
| CSSCodec | -Implementation of the Codec interface for backslash encoding frequently used in JavaScript. | -
| HTMLEntityCodec | -Implementation of the Codec interface for HTML entity encoding. | -
| JavaScriptCodec | -Implementation of the Codec interface for backslash encoding frequently used in JavaScript. | -
| MySQLCodec | -Implementation of the Codec interface for MySQL strings. | -
| OracleCodec | -Implementation of the Codec interface for Oracle strings. | -
| PercentCodec | -Implementation of the Codec interface for percent encoding (aka URL encoding). | -
| PushbackString | -The pushback string is used by Codecs to allow them to push decoded characters back onto a string - for further decoding. | -
| VBScriptCodec | -Implementation of the Codec interface for 'quote' encoding from VBScript. | -
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/package-tree.html b/javadoc/org/owasp/esapi/codecs/package-tree.html deleted file mode 100644 index f14f487dd..000000000 --- a/javadoc/org/owasp/esapi/codecs/package-tree.html +++ /dev/null @@ -1,165 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Hierarchy For Package org.owasp.esapi.codecs -
--
-
- Package Hierarchies:
- All Packages
-
-Class Hierarchy -
--
-
- class java.lang.Object
-
-
- class org.owasp.esapi.codecs.Base64
- class org.owasp.esapi.codecs.CSSCodec (implements org.owasp.esapi.codecs.Codec) -
- class org.owasp.esapi.codecs.HTMLEntityCodec (implements org.owasp.esapi.codecs.Codec) -
- class java.io.InputStream
-
-
- class java.io.FilterInputStream
-
-
- class org.owasp.esapi.codecs.Base64.InputStream
- class java.io.FilterInputStream
- class org.owasp.esapi.codecs.JavaScriptCodec (implements org.owasp.esapi.codecs.Codec) -
- class org.owasp.esapi.codecs.MySQLCodec (implements org.owasp.esapi.codecs.Codec) -
- class org.owasp.esapi.codecs.OracleCodec (implements org.owasp.esapi.codecs.Codec) -
- class java.io.OutputStream
-
-
- class java.io.FilterOutputStream
-
-
- class org.owasp.esapi.codecs.Base64.OutputStream
- class java.io.FilterOutputStream
- class org.owasp.esapi.codecs.PercentCodec (implements org.owasp.esapi.codecs.Codec) -
- class org.owasp.esapi.codecs.PushbackString
- class org.owasp.esapi.codecs.VBScriptCodec (implements org.owasp.esapi.codecs.Codec) -
-Interface Hierarchy -
--
-
- interface org.owasp.esapi.codecs.Codec
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/codecs/package-use.html b/javadoc/org/owasp/esapi/codecs/package-use.html deleted file mode 100644 index 4a3f9f567..000000000 --- a/javadoc/org/owasp/esapi/codecs/package-use.html +++ /dev/null @@ -1,211 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Package
org.owasp.esapi.codecs
-| -Packages that use org.owasp.esapi.codecs | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.codecs | -- |
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Classes in org.owasp.esapi.codecs used by org.owasp.esapi | -|
| Codec
-
- - The Codec interface defines a set of methods for encoding and decoding application level encoding schemes, - such as HTML entity encoding and percent encoding (aka URL encoding). |
-|
| -Classes in org.owasp.esapi.codecs used by org.owasp.esapi.codecs | -|
| Codec
-
- - The Codec interface defines a set of methods for encoding and decoding application level encoding schemes, - such as HTML entity encoding and percent encoding (aka URL encoding). |
-|
| PushbackString
-
- - The pushback string is used by Codecs to allow them to push decoded characters back onto a string - for further decoding. |
-|
| -Classes in org.owasp.esapi.codecs used by org.owasp.esapi.reference | -|
| Codec
-
- - The Codec interface defines a set of methods for encoding and decoding application level encoding schemes, - such as HTML entity encoding and percent encoding (aka URL encoding). |
-|
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/AccessControlException.html b/javadoc/org/owasp/esapi/errors/AccessControlException.html deleted file mode 100644 index 82c67d47d..000000000 --- a/javadoc/org/owasp/esapi/errors/AccessControlException.html +++ /dev/null @@ -1,277 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class AccessControlException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class AccessControlException
- extends EnterpriseSecurityException
-An AccessControlException should be thrown when a user attempts to access a - resource that they are not authorized for. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AccessControlException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EnterpriseSecurityException. |
-|
AccessControlException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new access control exception. |
-|
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AccessControlException
--public AccessControlException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EnterpriseSecurityException.
-
-
- -
-AccessControlException
--public AccessControlException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new access control exception.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/AuthenticationAccountsException.html b/javadoc/org/owasp/esapi/errors/AuthenticationAccountsException.html deleted file mode 100644 index faedaa7c0..000000000 --- a/javadoc/org/owasp/esapi/errors/AuthenticationAccountsException.html +++ /dev/null @@ -1,279 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class AuthenticationAccountsException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class AuthenticationAccountsException
- extends AuthenticationException
-An AuthenticationException should be thrown when anything goes wrong during - login or logout. They are also appropriate for any problems related to - identity management. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AuthenticationAccountsException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EnterpriseSecurityException. |
-|
AuthenticationAccountsException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new authentication exception. |
-|
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AuthenticationAccountsException
--public AuthenticationAccountsException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EnterpriseSecurityException.
-
-
- -
-AuthenticationAccountsException
--public AuthenticationAccountsException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new authentication exception.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/AuthenticationCredentialsException.html b/javadoc/org/owasp/esapi/errors/AuthenticationCredentialsException.html deleted file mode 100644 index 5982827f4..000000000 --- a/javadoc/org/owasp/esapi/errors/AuthenticationCredentialsException.html +++ /dev/null @@ -1,279 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class AuthenticationCredentialsException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class AuthenticationCredentialsException
- extends AuthenticationException
-An AuthenticationException should be thrown when anything goes wrong during - login or logout. They are also appropriate for any problems related to - identity management. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AuthenticationCredentialsException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EnterpriseSecurityException. |
-|
AuthenticationCredentialsException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new authentication exception. |
-|
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AuthenticationCredentialsException
--public AuthenticationCredentialsException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EnterpriseSecurityException.
-
-
- -
-AuthenticationCredentialsException
--public AuthenticationCredentialsException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new authentication exception.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/AuthenticationException.html b/javadoc/org/owasp/esapi/errors/AuthenticationException.html deleted file mode 100644 index b8501867b..000000000 --- a/javadoc/org/owasp/esapi/errors/AuthenticationException.html +++ /dev/null @@ -1,281 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class AuthenticationException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
- Direct Known Subclasses:
- AuthenticationAccountsException, AuthenticationCredentialsException, AuthenticationHostException, AuthenticationLoginException -
-
-
-
- public class AuthenticationException
- extends EnterpriseSecurityException
-An AuthenticationException should be thrown when anything goes wrong during - login or logout. They are also appropriate for any problems related to - identity management. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AuthenticationException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EnterpriseSecurityException. |
-|
AuthenticationException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new authentication exception. |
-|
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AuthenticationException
--public AuthenticationException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EnterpriseSecurityException.
-
-
- -
-AuthenticationException
--public AuthenticationException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new authentication exception.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/AuthenticationHostException.html b/javadoc/org/owasp/esapi/errors/AuthenticationHostException.html deleted file mode 100644 index 9d7b6a720..000000000 --- a/javadoc/org/owasp/esapi/errors/AuthenticationHostException.html +++ /dev/null @@ -1,278 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class AuthenticationHostException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class AuthenticationHostException
- extends AuthenticationException
-An AuthenticationHostException should be thrown when there is a problem with - the host involved with authentication, particularly if the host changes unexpectedly. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AuthenticationHostException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of AuthenticationHostException. |
-|
AuthenticationHostException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new authentication exception. |
-|
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AuthenticationHostException
--public AuthenticationHostException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of AuthenticationHostException.
-
-
- -
-AuthenticationHostException
--public AuthenticationHostException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new authentication exception.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/AuthenticationLoginException.html b/javadoc/org/owasp/esapi/errors/AuthenticationLoginException.html deleted file mode 100644 index e163301a9..000000000 --- a/javadoc/org/owasp/esapi/errors/AuthenticationLoginException.html +++ /dev/null @@ -1,279 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class AuthenticationLoginException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class AuthenticationLoginException
- extends AuthenticationException
-An AuthenticationException should be thrown when anything goes wrong during - login or logout. They are also appropriate for any problems related to - identity management. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AuthenticationLoginException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EnterpriseSecurityException. |
-|
AuthenticationLoginException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new authentication exception. |
-|
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AuthenticationLoginException
--public AuthenticationLoginException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EnterpriseSecurityException.
-
-
- -
-AuthenticationLoginException
--public AuthenticationLoginException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new authentication exception.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/AvailabilityException.html b/javadoc/org/owasp/esapi/errors/AvailabilityException.html deleted file mode 100644 index 460d0c5f9..000000000 --- a/javadoc/org/owasp/esapi/errors/AvailabilityException.html +++ /dev/null @@ -1,278 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class AvailabilityException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class AvailabilityException
- extends EnterpriseSecurityException
-An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy. For example, if a database connection pool runs out - of connections, an availability exception should be thrown. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
AvailabilityException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of AvailabilityException. |
-|
AvailabilityException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new AvailabilityException. |
-|
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AvailabilityException
--public AvailabilityException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of AvailabilityException.
-
-
- -
-AvailabilityException
--public AvailabilityException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new AvailabilityException.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/CertificateException.html b/javadoc/org/owasp/esapi/errors/CertificateException.html deleted file mode 100644 index 34047cd48..000000000 --- a/javadoc/org/owasp/esapi/errors/CertificateException.html +++ /dev/null @@ -1,277 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class CertificateException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class CertificateException
- extends EnterpriseSecurityException
-A CertificateException should be thrown for any problems that arise during - processing of digital certificates. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
CertificateException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of CertificateException. |
-|
CertificateException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new CertificateException. |
-|
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-CertificateException
--public CertificateException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of CertificateException.
-
-
- -
-CertificateException
--public CertificateException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new CertificateException.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/EncodingException.html b/javadoc/org/owasp/esapi/errors/EncodingException.html deleted file mode 100644 index 8c084587a..000000000 --- a/javadoc/org/owasp/esapi/errors/EncodingException.html +++ /dev/null @@ -1,277 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class EncodingException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class EncodingException
- extends EnterpriseSecurityException
-An ExecutorException should be thrown for any problems that occur when - encoding or decoding data. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
EncodingException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EncodingException. |
-|
EncodingException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new EncodingException. |
-|
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-EncodingException
--public EncodingException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EncodingException.
-
-
- -
-EncodingException
--public EncodingException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new EncodingException.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/EncryptionException.html b/javadoc/org/owasp/esapi/errors/EncryptionException.html deleted file mode 100644 index 9c64ef350..000000000 --- a/javadoc/org/owasp/esapi/errors/EncryptionException.html +++ /dev/null @@ -1,277 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class EncryptionException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class EncryptionException
- extends EnterpriseSecurityException
-An EncryptionException should be thrown for any problems related to - encryption, hashing, or digital signatures. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
EncryptionException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EncryptionException. |
-|
EncryptionException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new EncryptionException. |
-|
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-EncryptionException
--public EncryptionException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EncryptionException.
-
-
- -
-EncryptionException
--public EncryptionException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new EncryptionException.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/EnterpriseSecurityException.html b/javadoc/org/owasp/esapi/errors/EnterpriseSecurityException.html deleted file mode 100644 index 7d0d088ea..000000000 --- a/javadoc/org/owasp/esapi/errors/EnterpriseSecurityException.html +++ /dev/null @@ -1,334 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class EnterpriseSecurityException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
- Direct Known Subclasses:
- AccessControlException, AuthenticationException, AvailabilityException, CertificateException, EncodingException, EncryptionException, ExecutorException, IntegrityException, ValidationException -
-
-
-
- public class EnterpriseSecurityException
- extends java.lang.Exception
-EnterpriseSecurityException is the base class for all security related exceptions. You should pass in the root cause - exception where possible. Constructors for classes extending EnterpriseSecurityException should be sure to call the - appropriate super() method in order to ensure that logging and intrusion detection occur properly. -
- All EnterpriseSecurityExceptions have two messages, one for the user and one for the log file. This way, a message - can be shown to the user that doesn't contain sensitive information or unnecessary implementation details. Meanwhile, - all the critical information can be included in the exception so that it gets logged. -
- Note that the "logMessage" for ALL EnterpriseSecurityExceptions is logged in the log file. This feature should be - used extensively throughout ESAPI implementations and the result is a fairly complete set of security log records. - ALL EnterpriseSecurityExceptions are also sent to the IntrusionDetector for use in detecting anomolous patterns of - application usage. -
-
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
EnterpriseSecurityException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of EnterpriseSecurityException. |
-|
EnterpriseSecurityException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Creates a new instance of EnterpriseSecurityException that includes a root cause Throwable. |
-|
| -Method Summary | -|
- java.lang.String |
-getLogMessage()
-
-- |
-
- java.lang.String |
-getUserMessage()
-
-- |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-EnterpriseSecurityException
--public EnterpriseSecurityException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of EnterpriseSecurityException. This exception is automatically logged, so that simply by
- using this API, applications will generate an extensive security log. In addition, this exception is
- automatically registered with the IntrusionDetector, so that quotas can be checked.
-
-
- -
-EnterpriseSecurityException
--public EnterpriseSecurityException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Creates a new instance of EnterpriseSecurityException that includes a root cause Throwable.
-
-
- Parameters:
cause- the cause
| -Method Detail | -
-getUserMessage
--public java.lang.String getUserMessage()-
-
-
-
-
-
- -
-getLogMessage
--public java.lang.String getLogMessage()-
-
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/EnterpriseSecurityExceptionTest.html b/javadoc/org/owasp/esapi/errors/EnterpriseSecurityExceptionTest.html deleted file mode 100644 index 2fcfbb8b0..000000000 --- a/javadoc/org/owasp/esapi/errors/EnterpriseSecurityExceptionTest.html +++ /dev/null @@ -1,311 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class EnterpriseSecurityExceptionTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class EnterpriseSecurityExceptionTest
- extends junit.framework.TestCase
-The Class AccessReferenceMapTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
EnterpriseSecurityExceptionTest(java.lang.String testName)
-
-- Instantiates a new access reference map test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testExceptions()
-
-- Test of update method, of class org.owasp.esapi.AccessReferenceMap. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-EnterpriseSecurityExceptionTest
--public EnterpriseSecurityExceptionTest(java.lang.String testName)-
-
-
- Instantiates a new access reference map test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testExceptions
--public void testExceptions()-
-
-
- Test of update method, of class org.owasp.esapi.AccessReferenceMap.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/ExecutorException.html b/javadoc/org/owasp/esapi/errors/ExecutorException.html deleted file mode 100644 index 4e8f1fcfa..000000000 --- a/javadoc/org/owasp/esapi/errors/ExecutorException.html +++ /dev/null @@ -1,277 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class ExecutorException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class ExecutorException
- extends EnterpriseSecurityException
-An ExecutorException should be thrown for any problems that arise during the - execution of a system executable. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
ExecutorException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of ExecutorException. |
-|
ExecutorException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new ExecutorException. |
-|
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ExecutorException
--public ExecutorException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of ExecutorException.
-
-
- -
-ExecutorException
--public ExecutorException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new ExecutorException.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/IntegrityException.html b/javadoc/org/owasp/esapi/errors/IntegrityException.html deleted file mode 100644 index dd2ef5ef3..000000000 --- a/javadoc/org/owasp/esapi/errors/IntegrityException.html +++ /dev/null @@ -1,278 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class IntegrityException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class IntegrityException
- extends EnterpriseSecurityException
-An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy. For example, if a database connection pool runs out - of connections, an availability exception should be thrown. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
IntegrityException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of IntegrityException. |
-|
IntegrityException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new IntegrityException. |
-|
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-IntegrityException
--public IntegrityException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of IntegrityException.
-
-
- -
-IntegrityException
--public IntegrityException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new IntegrityException.
-
-
- Parameters:
cause- the cause
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/IntrusionException.html b/javadoc/org/owasp/esapi/errors/IntrusionException.html deleted file mode 100644 index 97eea8b8e..000000000 --- a/javadoc/org/owasp/esapi/errors/IntrusionException.html +++ /dev/null @@ -1,323 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class IntrusionException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class IntrusionException
- extends java.lang.RuntimeException
-An IntrusionException should be thrown anytime an error condition arises that is likely to be the result of an attack - in progress. IntrusionExceptions are handled specially by the IntrusionDetector, which is equipped to respond by - either specially logging the event, logging out the current user, or invalidating the current user's account. -
- Unlike other exceptions in the ESAPI, the IntrusionException is a RuntimeException so that it can be thrown from - anywhere and will not require a lot of special exception handling. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
IntrusionException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of IntrusionException. |
-|
IntrusionException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new intrusion exception. |
-|
| -Method Summary | -|
- java.lang.String |
-getLogMessage()
-
-- |
-
- java.lang.String |
-getUserMessage()
-
-- |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-IntrusionException
--public IntrusionException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of IntrusionException.
-
-
- -
-IntrusionException
--public IntrusionException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new intrusion exception.
-
-
- Parameters:
cause- the cause
| -Method Detail | -
-getUserMessage
--public java.lang.String getUserMessage()-
-
-
-
-
-
- -
-getLogMessage
--public java.lang.String getLogMessage()-
-
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/ValidationAvailabilityException.html b/javadoc/org/owasp/esapi/errors/ValidationAvailabilityException.html deleted file mode 100644 index 2aca62cb6..000000000 --- a/javadoc/org/owasp/esapi/errors/ValidationAvailabilityException.html +++ /dev/null @@ -1,282 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class ValidationAvailabilityException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class ValidationAvailabilityException
- extends ValidationException
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
ValidationAvailabilityException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Create a new ValidationException |
-|
ValidationAvailabilityException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Create a new ValidationException |
-|
| Methods inherited from class org.owasp.esapi.errors.ValidationException | -
getContext, getSerialVersionUID, setContext |
-
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ValidationAvailabilityException
--public ValidationAvailabilityException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Create a new ValidationException
-
-
- Parameters:
userMessage-logMessage-
- -
-ValidationAvailabilityException
--public ValidationAvailabilityException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Create a new ValidationException
-
-
- Parameters:
userMessage-logMessage-cause-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/ValidationException.html b/javadoc/org/owasp/esapi/errors/ValidationException.html deleted file mode 100644 index 2287f1ab5..000000000 --- a/javadoc/org/owasp/esapi/errors/ValidationException.html +++ /dev/null @@ -1,398 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class ValidationException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
- Direct Known Subclasses:
- ValidationAvailabilityException, ValidationUploadException -
-
-
-
- public class ValidationException
- extends EnterpriseSecurityException
-A ValidationException should be thrown to indicate that the data provided by - the user or from some other external source does not match the validation - rules that have been specified for that data. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
ValidationException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Creates a new instance of ValidationException. |
-|
ValidationException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.String context)
-
-- Creates a new instance of ValidationException. |
-|
ValidationException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Instantiates a new ValidationException. |
-|
ValidationException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause,
- java.lang.String context)
-
-- Instantiates a new ValidationException. |
-|
| -Method Summary | -|
- java.lang.String |
-getContext()
-
-- Returns the UI reference that caused this ValidationException |
-
-static long |
-getSerialVersionUID()
-
-- |
-
- void |
-setContext(java.lang.String context)
-
-- Set's the UI reference that caused this ValidationException |
-
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ValidationException
--public ValidationException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Creates a new instance of ValidationException.
-
-
- -
-ValidationException
--public ValidationException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Instantiates a new ValidationException.
-
-
- Parameters:
cause- the cause
- -
-ValidationException
--public ValidationException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.String context)-
-
-
- Creates a new instance of ValidationException.
-
-
- Parameters:
context- the source that caused this exception
- -
-ValidationException
--public ValidationException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause, - java.lang.String context)-
-
-
- Instantiates a new ValidationException.
-
-
- Parameters:
cause- the causecontext- the source that caused this exception
| -Method Detail | -
-getSerialVersionUID
--public static long getSerialVersionUID()-
-
-
-
-
-
- -
-getContext
--public java.lang.String getContext()-
-
-
- Returns the UI reference that caused this ValidationException
-
-
-
-
-
- Returns:
- -
-setContext
--public void setContext(java.lang.String context)-
-
-
- Set's the UI reference that caused this ValidationException
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/ValidationUploadException.html b/javadoc/org/owasp/esapi/errors/ValidationUploadException.html deleted file mode 100644 index 7604a3335..000000000 --- a/javadoc/org/owasp/esapi/errors/ValidationUploadException.html +++ /dev/null @@ -1,282 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.errors
-
-Class ValidationUploadException
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.io.Serializable -
-
-
-
- public class ValidationUploadException
- extends ValidationException
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
- Serialized Form
- -
| -Constructor Summary | -|
ValidationUploadException(java.lang.String userMessage,
- java.lang.String logMessage)
-
-- Create a new ValidationException |
-|
ValidationUploadException(java.lang.String userMessage,
- java.lang.String logMessage,
- java.lang.Throwable cause)
-
-- Create a new ValidationException |
-|
| Methods inherited from class org.owasp.esapi.errors.ValidationException | -
getContext, getSerialVersionUID, setContext |
-
| Methods inherited from class org.owasp.esapi.errors.EnterpriseSecurityException | -
getLogMessage, getUserMessage |
-
| Methods inherited from class java.lang.Throwable | -
fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ValidationUploadException
--public ValidationUploadException(java.lang.String userMessage, - java.lang.String logMessage)-
-
-
- Create a new ValidationException
-
-
- Parameters:
userMessage-logMessage-
- -
-ValidationUploadException
--public ValidationUploadException(java.lang.String userMessage, - java.lang.String logMessage, - java.lang.Throwable cause)-
-
-
- Create a new ValidationException
-
-
- Parameters:
userMessage-logMessage-cause-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/AccessControlException.html b/javadoc/org/owasp/esapi/errors/class-use/AccessControlException.html deleted file mode 100644 index 31d7e2d14..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/AccessControlException.html +++ /dev/null @@ -1,404 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.AccessControlException
-| -Packages that use AccessControlException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of AccessControlException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that throw AccessControlException | -|
- void |
-HTTPUtilities.assertSecureRequest(javax.servlet.http.HttpServletRequest request)
-
-- Ensures that the current request uses SSL and POST to protect any sensitive parameters - in the querystring from being sniffed or logged. |
-
- void |
-HTTPUtilities.safeSendForward(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response,
- java.lang.String context,
- java.lang.String location)
-
-- This method perform a forward to any resource located inside the WEB-INF directory. |
-
- java.lang.Object |
-AccessReferenceMap.getDirectReference(java.lang.String indirectReference)
-
-- Get the original direct object reference from an indirect reference. |
-
- java.lang.String |
-AccessReferenceMap.removeDirectReference(java.lang.Object direct)
-
-- Removes a direct reference and its associated indirect reference from the AccessReferenceMap. |
-
- void |
-AccessController.assertAuthorizedForURL(java.lang.String url)
-
-- Checks if an account is authorized to access the referenced URL. |
-
- void |
-AccessController.assertAuthorizedForFunction(java.lang.String functionName)
-
-- Checks if an account is authorized to access the referenced function. |
-
- void |
-AccessController.assertAuthorizedForData(java.lang.String key)
-
-- Checks if an account is authorized to access the referenced data. |
-
- void |
-AccessController.assertAuthorizedForFile(java.lang.String filepath)
-
-- Checks if an account is authorized to access the referenced file. |
-
- void |
-AccessController.assertAuthorizedForService(java.lang.String serviceName)
-
-- Checks if an account is authorized to access the referenced service. |
-
| -Uses of AccessControlException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw AccessControlException | -|
- java.lang.String |
-RandomAccessReferenceMap.removeDirectReference(java.lang.Object direct)
-
-- Remove a direct reference and the corresponding indirect reference. |
-
- java.lang.Object |
-RandomAccessReferenceMap.getDirectReference(java.lang.String indirectReference)
-
-- |
-
- java.lang.String |
-IntegerAccessReferenceMap.removeDirectReference(java.lang.Object direct)
-
-- Remove a direct reference and the corresponding indirect reference. |
-
- java.lang.Object |
-IntegerAccessReferenceMap.getDirectReference(java.lang.String indirectReference)
-
-- |
-
- void |
-FileBasedAccessController.assertAuthorizedForURL(java.lang.String url)
-
-- |
-
- void |
-FileBasedAccessController.assertAuthorizedForFunction(java.lang.String functionName)
-
-- |
-
- void |
-FileBasedAccessController.assertAuthorizedForData(java.lang.String key)
-
-- |
-
- void |
-FileBasedAccessController.assertAuthorizedForFile(java.lang.String filepath)
-
-- |
-
- void |
-FileBasedAccessController.assertAuthorizedForService(java.lang.String serviceName)
-
-- |
-
- void |
-DefaultHTTPUtilities.assertSecureRequest(javax.servlet.http.HttpServletRequest request)
-
-- Verifies that the request is "secure" by checking that the method is a POST and - that SSL has been used. |
-
- void |
-DefaultHTTPUtilities.safeSendForward(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response,
- java.lang.String context,
- java.lang.String location)
-
-- |
-
- void |
-IntegerAccessReferenceMapTest.testGetDirectReference()
-
-- Test of getDirectReference method, of class - org.owasp.esapi.AccessReferenceMap. |
-
- void |
-IntegerAccessReferenceMapTest.testAddDirectReference()
-
-- |
-
- void |
-IntegerAccessReferenceMapTest.testRemoveDirectReference()
-
-- |
-
- void |
-AccessReferenceMapTest.testGetDirectReference()
-
-- Test of getDirectReference method, of class - org.owasp.esapi.AccessReferenceMap. |
-
- void |
-AccessReferenceMapTest.testAddDirectReference()
-
-- |
-
- void |
-AccessReferenceMapTest.testRemoveDirectReference()
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/AuthenticationAccountsException.html b/javadoc/org/owasp/esapi/errors/class-use/AuthenticationAccountsException.html deleted file mode 100644 index 3adaeb3b2..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/AuthenticationAccountsException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.AuthenticationAccountsException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/AuthenticationCredentialsException.html b/javadoc/org/owasp/esapi/errors/class-use/AuthenticationCredentialsException.html deleted file mode 100644 index 759003168..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/AuthenticationCredentialsException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.AuthenticationCredentialsException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/AuthenticationException.html b/javadoc/org/owasp/esapi/errors/class-use/AuthenticationException.html deleted file mode 100644 index 924d40a01..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/AuthenticationException.html +++ /dev/null @@ -1,790 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.AuthenticationException
-| -Packages that use AuthenticationException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.errors | -A set of exception classes designed to model the error conditions that -frequently arise in enterprise web applications and web services. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of AuthenticationException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that throw AuthenticationException | -|
- void |
-User.addRole(java.lang.String role)
-
-- Adds a role to an account. |
-
- void |
-User.addRoles(java.util.Set newRoles)
-
-- Adds a set of roles to an account. |
-
- void |
-User.changePassword(java.lang.String oldPassword,
- java.lang.String newPassword1,
- java.lang.String newPassword2)
-
-- Sets the user's password, performing a verification of the user's old password, the equality of the two new - passwords, and the strength of the new password. |
-
- java.util.Date |
-User.getLastFailedLoginTime()
-
-- Returns the date of the last failed login time for a user. |
-
- void |
-User.loginWithPassword(java.lang.String password)
-
-- Login with password. |
-
- void |
-User.removeRole(java.lang.String role)
-
-- Removes a role from an account. |
-
- java.lang.String |
-User.resetCSRFToken()
-
-- Returns a token to be used as a prevention against CSRF attacks. |
-
- void |
-User.setRoles(java.util.Set roles)
-
-- Sets the roles of this account. |
-
- javax.servlet.http.HttpSession |
-HTTPUtilities.changeSessionIdentifier(javax.servlet.http.HttpServletRequest request)
-
-- Invalidate the old session after copying all of its contents to a newly created session with a new session id. |
-
- User |
-Authenticator.login(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- Authenticates the user's credentials from the HttpServletRequest if - necessary, creates a session if necessary, and sets the user as the - current user. |
-
- User |
-Authenticator.createUser(java.lang.String accountName,
- java.lang.String password1,
- java.lang.String password2)
-
-- Creates a new User with the information provided. |
-
- void |
-Authenticator.changePassword(User user,
- java.lang.String currentPassword,
- java.lang.String newPassword,
- java.lang.String newPassword2)
-
-- Changes the password for the specified user. |
-
- void |
-Authenticator.removeUser(java.lang.String accountName)
-
-- Removes the account. |
-
- void |
-Authenticator.verifyAccountNameStrength(java.lang.String accountName)
-
-- Ensures that the account name passes site-specific complexity requirements, like minimum length. |
-
- void |
-Authenticator.verifyPasswordStrength(java.lang.String oldPassword,
- java.lang.String newPassword)
-
-- Ensures that the password meets site-specific complexity requirements. |
-
| -Uses of AuthenticationException in org.owasp.esapi.errors | -
- -
| Subclasses of AuthenticationException in org.owasp.esapi.errors | -|
- class |
-AuthenticationAccountsException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
- class |
-AuthenticationCredentialsException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
- class |
-AuthenticationHostException
-
-- An AuthenticationHostException should be thrown when there is a problem with - the host involved with authentication, particularly if the host changes unexpectedly. |
-
- class |
-AuthenticationLoginException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
| -Uses of AuthenticationException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw AuthenticationException | -|
- User |
-FileBasedAuthenticator.createUser(java.lang.String accountName,
- java.lang.String password1,
- java.lang.String password2)
-
-- |
-
- void |
-FileBasedAuthenticator.changePassword(User user,
- java.lang.String currentPassword,
- java.lang.String newPassword,
- java.lang.String newPassword2)
-
-- |
-
- void |
-FileBasedAuthenticator.removeUser(java.lang.String accountName)
-
-- |
-
- User |
-FileBasedAuthenticator.login(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- This method should be called for every HTTP request, to login the current user either from the session of HTTP - request. |
-
- void |
-FileBasedAuthenticator.verifyAccountNameStrength(java.lang.String newAccountName)
-
-- |
-
- void |
-FileBasedAuthenticator.verifyPasswordStrength(java.lang.String oldPassword,
- java.lang.String newPassword)
-
-- |
-
- void |
-DefaultUser.addRole(java.lang.String role)
-
-- |
-
- void |
-DefaultUser.addRoles(java.util.Set newRoles)
-
-- |
-
- void |
-DefaultUser.changePassword(java.lang.String oldPassword,
- java.lang.String newPassword1,
- java.lang.String newPassword2)
-
-- |
-
- void |
-DefaultUser.loginWithPassword(java.lang.String password)
-
-- |
-
- void |
-DefaultUser.setRoles(java.util.Set roles)
-
-- Sets the roles. |
-
- javax.servlet.http.HttpSession |
-DefaultHTTPUtilities.changeSessionIdentifier(javax.servlet.http.HttpServletRequest request)
-
-- |
-
- void |
-UserTest.testAddRoles()
-
-- Test of addRoles method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testDisable()
-
-- Test of disable method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testEnable()
-
-- Test of enable method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testFailedLoginLockout()
-
-- Test of failedLoginCount lockout, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testGetAccountName()
-
-- Test of getAccountName method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testGetScreenName()
-
-- Test of xxx method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testIncrementFailedLoginCount()
-
-- Test of incrementFailedLoginCount method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testIsEnabled()
-
-- Test of isEnabled method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testIsInRole()
-
-- Test of isInRole method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testIsLocked()
-
-- Test of xxx method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testIsSessionAbsoluteTimeout()
-
-- Test of isSessionAbsoluteTimeout method, of class - org.owasp.esapi.IntrusionDetector. |
-
- void |
-UserTest.testIsSessionTimeout()
-
-- Test of isSessionTimeout method, of class - org.owasp.esapi.IntrusionDetector. |
-
- void |
-UserTest.testLock()
-
-- Test of lockAccount method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testLoginWithPassword()
-
-- Test of loginWithPassword method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testLogout()
-
-- Test of logout method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testRemoveRole()
-
-- Test of testRemoveRole method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testResetCSRFToken()
-
-- Test of testResetCSRFToken method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testSetAccountName()
-
-- Test of setAccountName method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testSetRoles()
-
-- Test of setRoles method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testSetScreenName()
-
-- Test of setScreenName method, of class org.owasp.esapi.User. |
-
- void |
-UserTest.testUnlock()
-
-- Test of unlockAccount method, of class org.owasp.esapi.User. |
-
- void |
-LoggerTest.testLogHTTPRequest()
-
-- Test of logHTTPRequest method, of class org.owasp.esapi.Logger. |
-
- void |
-IntrusionDetectorTest.testAddException()
-
-- Test of addException method, of class org.owasp.esapi.IntrusionDetector. |
-
- void |
-IntrusionDetectorTest.testAddEvent()
-
-- Test of addEvent method, of class org.owasp.esapi.IntrusionDetector. |
-
- void |
-IntegerAccessReferenceMapTest.testUpdate()
-
-- Test of update method, of class org.owasp.esapi.AccessReferenceMap. |
-
- void |
-HTTPUtilitiesTest.testAddCSRFToken()
-
-- Test of addCSRFToken method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-HTTPUtilitiesTest.testSetRememberToken()
-
-- |
-
- void |
-AuthenticatorTest.testCreateUser()
-
-- Test of createAccount method, of class org.owasp.esapi.Authenticator. |
-
- void |
-AuthenticatorTest.testGenerateStrongPassword()
-
-- Test of generateStrongPassword method, of class - org.owasp.esapi.Authenticator. |
-
- void |
-AuthenticatorTest.testGetUser()
-
-- Test of getUser method, of class org.owasp.esapi.Authenticator. |
-
- void |
-AuthenticatorTest.testGetUserFromRememberToken()
-
-- |
-
- void |
-AuthenticatorTest.testGetUserFromSession()
-
-- Test get user from session. |
-
- void |
-AuthenticatorTest.testGetUserNames()
-
-- Test get user names. |
-
- void |
-AuthenticatorTest.testLogin()
-
-- Test of login method, of class org.owasp.esapi.Authenticator. |
-
- void |
-AuthenticatorTest.testSetCurrentUser()
-
-- Test of setCurrentUser method, of class org.owasp.esapi.Authenticator. |
-
- void |
-AuthenticatorTest.testSetCurrentUserWithRequest()
-
-- Test of setCurrentUser method, of class org.owasp.esapi.Authenticator. |
-
- void |
-AuthenticatorTest.testValidatePasswordStrength()
-
-- Test of validatePasswordStrength method, of class - org.owasp.esapi.Authenticator. |
-
- void |
-AccessReferenceMapTest.testUpdate()
-
-- Test of update method, of class org.owasp.esapi.AccessReferenceMap. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/AuthenticationHostException.html b/javadoc/org/owasp/esapi/errors/class-use/AuthenticationHostException.html deleted file mode 100644 index 9b4cf20e8..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/AuthenticationHostException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.AuthenticationHostException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/AuthenticationLoginException.html b/javadoc/org/owasp/esapi/errors/class-use/AuthenticationLoginException.html deleted file mode 100644 index a4e0b607c..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/AuthenticationLoginException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.AuthenticationLoginException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/AvailabilityException.html b/javadoc/org/owasp/esapi/errors/class-use/AvailabilityException.html deleted file mode 100644 index 1548def79..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/AvailabilityException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.AvailabilityException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/CertificateException.html b/javadoc/org/owasp/esapi/errors/class-use/CertificateException.html deleted file mode 100644 index d38ce80e2..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/CertificateException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.CertificateException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/EncodingException.html b/javadoc/org/owasp/esapi/errors/class-use/EncodingException.html deleted file mode 100644 index 0c1395e42..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/EncodingException.html +++ /dev/null @@ -1,244 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.EncodingException
-| -Packages that use EncodingException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of EncodingException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that throw EncodingException | -|
- java.lang.String |
-Encoder.canonicalize(java.lang.String input)
-
-- This method performs canonicalization on data received to ensure that it - has been reduced to its most basic form before validation. |
-
- java.lang.String |
-Encoder.canonicalize(java.lang.String input,
- boolean strict)
-
-- |
-
- java.lang.String |
-Encoder.encodeForURL(java.lang.String input)
-
-- Encode for use in a URL. |
-
- java.lang.String |
-Encoder.decodeFromURL(java.lang.String input)
-
-- Decode from URL. |
-
| -Uses of EncodingException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw EncodingException | -|
- java.lang.String |
-DefaultEncoder.encodeForURL(java.lang.String input)
-
-- |
-
- java.lang.String |
-DefaultEncoder.decodeFromURL(java.lang.String input)
-
-- |
-
- void |
-EncoderTest.testCanonicalize()
-
-- Test of canonicalize method, of class org.owasp.esapi.Encoder. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/EncryptionException.html b/javadoc/org/owasp/esapi/errors/class-use/EncryptionException.html deleted file mode 100644 index 08958e589..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/EncryptionException.html +++ /dev/null @@ -1,549 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.EncryptionException
-| -Packages that use EncryptionException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of EncryptionException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that throw EncryptionException | -|
- void |
-User.changePassword(java.lang.String oldPassword,
- java.lang.String newPassword1,
- java.lang.String newPassword2)
-
-- Sets the user's password, performing a verification of the user's old password, the equality of the two new - passwords, and the strength of the new password. |
-
- boolean |
-User.verifyPassword(java.lang.String password)
-
-- Verify that the supplied password matches the password for this user. |
-
- java.lang.String |
-Randomizer.getRandomGUID()
-
-- Generates a random GUID. |
-
- java.lang.String |
-HTTPUtilities.encryptHiddenField(java.lang.String value)
-
-- Encrypts a hidden field value for use in HTML. |
-
- java.lang.String |
-HTTPUtilities.encryptQueryString(java.lang.String query)
-
-- Takes a querystring (i.e. |
-
- java.util.Map |
-HTTPUtilities.decryptQueryString(java.lang.String encrypted)
-
-- Takes an encrypted querystring and returns a Map containing the original parameters. |
-
- java.util.Map |
-HTTPUtilities.decryptStateFromCookie(javax.servlet.http.HttpServletRequest request)
-
-- Retrieves a map of data from a cookie encrypted with encryptStateInCookie(). |
-
- void |
-HTTPUtilities.encryptStateInCookie(javax.servlet.http.HttpServletResponse response,
- java.util.Map cleartext)
-
-- Stores a Map of data in an encrypted cookie. |
-
- java.lang.String |
-Encryptor.hash(java.lang.String plaintext,
- java.lang.String salt)
-
-- Returns a string representation of the hash of the provided plaintext and - salt. |
-
- java.lang.String |
-Encryptor.encrypt(java.lang.String plaintext)
-
-- Encrypts the provided plaintext and returns a ciphertext string. |
-
- java.lang.String |
-Encryptor.decrypt(java.lang.String ciphertext)
-
-- Decrypts the provided ciphertext string (encrypted with the encrypt - method) and returns a plaintext string. |
-
- java.lang.String |
-Encryptor.sign(java.lang.String data)
-
-- Create a digital signature for the provided data and return it in a - string. |
-
- java.lang.String |
-Encryptor.unseal(java.lang.String seal)
-
-- Unseals data (created with the seal method) and throws an exception - describing any of the various problems that could exist with a seal, such - as an invalid seal format, expired timestamp, or decryption error. |
-
- java.lang.String |
-EncryptedProperties.getProperty(java.lang.String key)
-
-- Gets the property value from the encrypted store, decrypts it, and returns the plaintext value to the caller. |
-
- java.lang.String |
-EncryptedProperties.setProperty(java.lang.String key,
- java.lang.String value)
-
-- Encrypts the plaintext property value and stores the ciphertext value in the encrypted store. |
-
- java.lang.String |
-Authenticator.hashPassword(java.lang.String password,
- java.lang.String accountName)
-
-- Returns a string representation of the hashed password, using the - accountName as the salt. |
-
| -Uses of EncryptionException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw EncryptionException | -|
- java.lang.String |
-JavaEncryptor.hash(java.lang.String plaintext,
- java.lang.String salt)
-
-- Hashes the data using the specified algorithm and the Java MessageDigest class. |
-
- java.lang.String |
-JavaEncryptor.encrypt(java.lang.String plaintext)
-
-- |
-
- java.lang.String |
-JavaEncryptor.decrypt(java.lang.String ciphertext)
-
-- |
-
- java.lang.String |
-JavaEncryptor.sign(java.lang.String data)
-
-- |
-
- java.lang.String |
-JavaEncryptor.unseal(java.lang.String seal)
-
-- |
-
- java.lang.String |
-FileBasedAuthenticator.hashPassword(java.lang.String password,
- java.lang.String accountName)
-
-- |
-
- void |
-DefaultUser.changePassword(java.lang.String oldPassword,
- java.lang.String newPassword1,
- java.lang.String newPassword2)
-
-- |
-
- java.lang.String |
-DefaultRandomizer.getRandomGUID()
-
-- |
-
- java.util.Map |
-DefaultHTTPUtilities.decryptQueryString(java.lang.String encrypted)
-
-- |
-
- java.util.Map |
-DefaultHTTPUtilities.decryptStateFromCookie(javax.servlet.http.HttpServletRequest request)
-
-- |
-
- java.lang.String |
-DefaultHTTPUtilities.encryptHiddenField(java.lang.String value)
-
-- |
-
- java.lang.String |
-DefaultHTTPUtilities.encryptQueryString(java.lang.String query)
-
-- |
-
- void |
-DefaultHTTPUtilities.encryptStateInCookie(javax.servlet.http.HttpServletResponse response,
- java.util.Map cleartext)
-
-- |
-
- java.lang.String |
-DefaultEncryptedProperties.getProperty(java.lang.String key)
-
-- |
-
- java.lang.String |
-DefaultEncryptedProperties.setProperty(java.lang.String key,
- java.lang.String value)
-
-- |
-
- void |
-UserTest.testFailedLoginLockout()
-
-- Test of failedLoginCount lockout, of class org.owasp.esapi.User. |
-
- void |
-RandomizerTest.testGetRandomGUID()
-
-- Test of getRandomGUID method, of class org.owasp.esapi.Randomizer. |
-
- void |
-IntegerAccessReferenceMapTest.testUpdate()
-
-- Test of update method, of class org.owasp.esapi.AccessReferenceMap. |
-
- void |
-EncryptorTest.testHash()
-
-- Test of hash method, of class org.owasp.esapi.Encryptor. |
-
- void |
-EncryptorTest.testEncrypt()
-
-- Test of encrypt method, of class org.owasp.esapi.Encryptor. |
-
- void |
-EncryptorTest.testSign()
-
-- Test of sign method, of class org.owasp.esapi.Encryptor. |
-
- void |
-EncryptorTest.testVerifySignature()
-
-- Test of verifySignature method, of class org.owasp.esapi.Encryptor. |
-
- void |
-EncryptedPropertiesTest.testGetProperty()
-
-- Test of getProperty method, of class org.owasp.esapi.EncryptedProperties. |
-
- void |
-EncryptedPropertiesTest.testSetProperty()
-
-- Test of setProperty method, of class org.owasp.esapi.EncryptedProperties. |
-
- void |
-AuthenticatorTest.testCreateUser()
-
-- Test of createAccount method, of class org.owasp.esapi.Authenticator. |
-
- void |
-AuthenticatorTest.testHashPassword()
-
-- Test of hashPassword method, of class org.owasp.esapi.Authenticator. |
-
- void |
-AccessReferenceMapTest.testUpdate()
-
-- Test of update method, of class org.owasp.esapi.AccessReferenceMap. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/EnterpriseSecurityException.html b/javadoc/org/owasp/esapi/errors/class-use/EnterpriseSecurityException.html deleted file mode 100644 index c49f0852b..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/EnterpriseSecurityException.html +++ /dev/null @@ -1,336 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.EnterpriseSecurityException
-| -Packages that use EnterpriseSecurityException | -|
| org.owasp.esapi.errors | -A set of exception classes designed to model the error conditions that -frequently arise in enterprise web applications and web services. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of EnterpriseSecurityException in org.owasp.esapi.errors | -
- -
| Subclasses of EnterpriseSecurityException in org.owasp.esapi.errors | -|
- class |
-AccessControlException
-
-- An AccessControlException should be thrown when a user attempts to access a - resource that they are not authorized for. |
-
- class |
-AuthenticationAccountsException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
- class |
-AuthenticationCredentialsException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
- class |
-AuthenticationException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
- class |
-AuthenticationHostException
-
-- An AuthenticationHostException should be thrown when there is a problem with - the host involved with authentication, particularly if the host changes unexpectedly. |
-
- class |
-AuthenticationLoginException
-
-- An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-
- class |
-AvailabilityException
-
-- An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy. |
-
- class |
-CertificateException
-
-- A CertificateException should be thrown for any problems that arise during - processing of digital certificates. |
-
- class |
-EncodingException
-
-- An ExecutorException should be thrown for any problems that occur when - encoding or decoding data. |
-
- class |
-EncryptionException
-
-- An EncryptionException should be thrown for any problems related to - encryption, hashing, or digital signatures. |
-
- class |
-ExecutorException
-
-- An ExecutorException should be thrown for any problems that arise during the - execution of a system executable. |
-
- class |
-IntegrityException
-
-- An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy. |
-
- class |
-ValidationAvailabilityException
-
-- |
-
- class |
-ValidationException
-
-- A ValidationException should be thrown to indicate that the data provided by - the user or from some other external source does not match the validation - rules that have been specified for that data. |
-
- class |
-ValidationUploadException
-
-- |
-
| -Uses of EnterpriseSecurityException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw EnterpriseSecurityException | -|
- void |
-HTTPUtilitiesTest.testChangeSessionIdentifier()
-
-- Test of sendRedirect method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-EncryptorTest.testVerifySeal()
-
-- Test of verifySeal method, of class org.owasp.esapi.Encryptor. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/EnterpriseSecurityExceptionTest.html b/javadoc/org/owasp/esapi/errors/class-use/EnterpriseSecurityExceptionTest.html deleted file mode 100644 index 30d42e8c7..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/EnterpriseSecurityExceptionTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.EnterpriseSecurityExceptionTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/ExecutorException.html b/javadoc/org/owasp/esapi/errors/class-use/ExecutorException.html deleted file mode 100644 index d9b76180b..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/ExecutorException.html +++ /dev/null @@ -1,210 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.ExecutorException
-| -Packages that use ExecutorException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of ExecutorException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that throw ExecutorException | -|
- java.lang.String |
-Executor.executeSystemCommand(java.io.File executable,
- java.util.List params,
- java.io.File workdir,
- int timeoutSeconds)
-
-- Executes a system command after checking that the executable exists and - that the parameters have not been subject to injection with untrusted - user data. |
-
| -Uses of ExecutorException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw ExecutorException | -|
- java.lang.String |
-DefaultExecutor.executeSystemCommand(java.io.File executable,
- java.util.List params,
- java.io.File workdir,
- int timeoutSeconds)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/IntegrityException.html b/javadoc/org/owasp/esapi/errors/class-use/IntegrityException.html deleted file mode 100644 index 8ee2272a6..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/IntegrityException.html +++ /dev/null @@ -1,212 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.IntegrityException
-| -Packages that use IntegrityException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of IntegrityException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that throw IntegrityException | -|
- java.lang.String |
-Encryptor.seal(java.lang.String data,
- long timestamp)
-
-- Creates a seal that binds a set of data and includes an expiration timestamp. |
-
| -Uses of IntegrityException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw IntegrityException | -|
- java.lang.String |
-JavaEncryptor.seal(java.lang.String data,
- long expiration)
-
-- |
-
- void |
-EncryptorTest.testSeal()
-
-- Test of seal method, of class org.owasp.esapi.Encryptor. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/IntrusionException.html b/javadoc/org/owasp/esapi/errors/class-use/IntrusionException.html deleted file mode 100644 index 6abff3a46..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/IntrusionException.html +++ /dev/null @@ -1,1324 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.IntrusionException
-| -Packages that use IntrusionException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of IntrusionException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that throw IntrusionException | -|
- boolean |
-Validator.isValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input is valid according to the specified type. |
-
- java.lang.String |
-Validator.getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated input as a String. |
-
- java.lang.String |
-Validator.getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns canonicalized and validated input as a String. |
-
- boolean |
-Validator.isValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns true if input is a valid date according to the specified date format. |
-
- java.util.Date |
-Validator.getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns a valid date as a Date. |
-
- java.util.Date |
-Validator.getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a valid date as a Date. |
-
- boolean |
-Validator.isValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input is "safe" HTML. |
-
- java.lang.String |
-Validator.getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated "safe" HTML. |
-
- java.lang.String |
-Validator.getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns canonicalized and validated "safe" HTML. |
-
- boolean |
-Validator.isValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid credit card. |
-
- java.lang.String |
-Validator.getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- java.lang.String |
-Validator.getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- boolean |
-Validator.isValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid directory path. |
-
- java.lang.String |
-Validator.getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- java.lang.String |
-Validator.getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- boolean |
-Validator.isValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid file name. |
-
- java.lang.String |
-Validator.getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated file name as a String. |
-
- java.lang.String |
-Validator.getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a canonicalized and validated file name as a String. |
-
- boolean |
-Validator.isValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid number within the range of minValue to maxValue. |
-
- java.lang.Double |
-Validator.getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double within the range of minValue to maxValue. |
-
- java.lang.Double |
-Validator.getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a validated number as a double within the range of minValue to maxValue. |
-
- boolean |
-Validator.isValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid integer within the range of minValue to maxValue. |
-
- java.lang.Integer |
-Validator.getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns a validated integer. |
-
- java.lang.Integer |
-Validator.getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a validated integer. |
-
- boolean |
-Validator.isValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid double within the range of minValue to maxValue. |
-
- java.lang.Double |
-Validator.getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns a validated real number as a double. |
-
- java.lang.Double |
-Validator.getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a validated real number as a double. |
-
- boolean |
-Validator.isValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if input is valid file content. |
-
- byte[] |
-Validator.getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns validated file content as a byte array. |
-
- byte[] |
-Validator.getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns validated file content as a byte array. |
-
- boolean |
-Validator.isValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if a file upload has a valid name, path, and content. |
-
- void |
-Validator.assertValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Validates the filepath, filename, and content of a file. |
-
- void |
-Validator.assertValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Validates the filepath, filename, and content of a file. |
-
- boolean |
-Validator.isValidHTTPRequest()
-
-- Validate the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- void |
-Validator.assertIsValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- boolean |
-Validator.isValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns true if input is a valid list item. |
-
- java.lang.String |
-Validator.getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- java.lang.String |
-Validator.getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list,
- ValidationErrorList errorList)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- boolean |
-Validator.isValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Returns true if the parameters in the current request contain all required parameters and only optional ones in addition. |
-
- void |
-Validator.assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- void |
-Validator.assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional,
- ValidationErrorList errorList)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- boolean |
-Validator.isValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input contains only valid printable ASCII characters. |
-
- byte[] |
-Validator.getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns canonicalized and validated printable characters as a byte array. |
-
- boolean |
-Validator.isValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input contains only valid printable ASCII characters (32-126). |
-
- java.lang.String |
-Validator.getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns canonicalized and validated printable characters as a String. |
-
- boolean |
-Validator.isValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid redirect location, as defined by "ESAPI.properties". |
-
- java.lang.String |
-Validator.getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated redirect location as a String. |
-
- java.lang.String |
-Validator.getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errorList)
-
-- Returns a canonicalized and validated redirect location as a String. |
-
- void |
-IntrusionDetector.addException(java.lang.Exception exception)
-
-- Adds the exception to the IntrusionDetector. |
-
- void |
-IntrusionDetector.addEvent(java.lang.String eventName,
- java.lang.String logMessage)
-
-- Adds the event to the IntrusionDetector. |
-
- void |
-HTTPUtilities.verifyCSRFToken(javax.servlet.http.HttpServletRequest request)
-
-- Checks the CSRF token in the URL (see User.getCSRFToken()) against the user's CSRF token and - throws an IntrusionException if it is missing. |
-
| -Uses of IntrusionException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw IntrusionException | -|
- boolean |
-DefaultValidator.isValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Returns true if data received from browser is valid. |
-
- java.lang.String |
-DefaultValidator.getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Validates data received from the browser and returns a safe version. |
-
- java.lang.String |
-DefaultValidator.getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errors)
-
-- Validates data received from the browser and returns a safe version. |
-
- boolean |
-DefaultValidator.isValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns true if input is a valid date according to the specified date format. |
-
- java.util.Date |
-DefaultValidator.getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- |
-
- java.util.Date |
-DefaultValidator.getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull,
- ValidationErrorList errors)
-
-- |
-
- boolean |
-DefaultValidator.isValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- |
-
- java.lang.String |
-DefaultValidator.getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- |
-
- java.lang.String |
-DefaultValidator.getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidSafeHTML |
-
- boolean |
-DefaultValidator.isValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- |
-
- java.lang.String |
-DefaultValidator.getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- java.lang.String |
-DefaultValidator.getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidCreditCard |
-
- boolean |
-DefaultValidator.isValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if the directory path (not including a filename) is valid. |
-
- java.lang.String |
-DefaultValidator.getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- java.lang.String |
-DefaultValidator.getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidDirectoryPath |
-
- boolean |
-DefaultValidator.isValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid file name. |
-
- java.lang.String |
-DefaultValidator.getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated file name as a String. |
-
- java.lang.String |
-DefaultValidator.getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errors)
-
-- Returns a canonicalized and validated file name as a String. |
-
- boolean |
-DefaultValidator.isValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- |
-
- java.lang.Double |
-DefaultValidator.getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- java.lang.Double |
-DefaultValidator.getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull,
- ValidationErrorList errors)
-
-- |
-
- boolean |
-DefaultValidator.isValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- |
-
- java.lang.Double |
-DefaultValidator.getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- java.lang.Double |
-DefaultValidator.getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull,
- ValidationErrorList errors)
-
-- |
-
- boolean |
-DefaultValidator.isValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- |
-
- java.lang.Integer |
-DefaultValidator.getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- java.lang.Integer |
-DefaultValidator.getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull,
- ValidationErrorList errors)
-
-- |
-
- boolean |
-DefaultValidator.isValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if input is valid file content. |
-
- byte[] |
-DefaultValidator.getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns validated file content as a byte array. |
-
- byte[] |
-DefaultValidator.getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull,
- ValidationErrorList errors)
-
-- |
-
- boolean |
-DefaultValidator.isValidFileUpload(java.lang.String context,
- java.lang.String directorypath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if a file upload has a valid name, path, and content. |
-
- void |
-DefaultValidator.assertValidFileUpload(java.lang.String context,
- java.lang.String directorypath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Validates the filepath, filename, and content of a file. |
-
- void |
-DefaultValidator.assertValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of assertValidFileUpload |
-
- boolean |
-DefaultValidator.isValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- boolean |
-DefaultValidator.isValidHTTPRequest(javax.servlet.http.HttpServletRequest request)
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- void |
-DefaultValidator.assertIsValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- java.lang.String |
-DefaultValidator.getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- java.lang.String |
-DefaultValidator.getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidListItem |
-
- void |
-DefaultValidator.assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- void |
-DefaultValidator.assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of assertIsValidHTTPRequestParameterSet |
-
- boolean |
-DefaultValidator.isValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Checks that all bytes are valid ASCII characters (between 33 and 126 - inclusive). |
-
- byte[] |
-DefaultValidator.getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a byte array. |
-
- byte[] |
-DefaultValidator.getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidPrintable |
-
- boolean |
-DefaultValidator.isValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- |
-
- java.lang.String |
-DefaultValidator.getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a String. |
-
- java.lang.String |
-DefaultValidator.getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidPrintable |
-
- boolean |
-DefaultValidator.isValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid redirect location. |
-
- java.lang.String |
-DefaultValidator.getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated redirect location as a String. |
-
- java.lang.String |
-DefaultValidator.getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidRedirectLocation |
-
- void |
-DefaultIntrusionDetector.addEvent(java.lang.String eventName,
- java.lang.String logMessage)
-
-- Adds the event to the IntrusionDetector. |
-
- void |
-DefaultHTTPUtilities.verifyCSRFToken(javax.servlet.http.HttpServletRequest request)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/ValidationAvailabilityException.html b/javadoc/org/owasp/esapi/errors/class-use/ValidationAvailabilityException.html deleted file mode 100644 index 7b9be6b5e..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/ValidationAvailabilityException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.ValidationAvailabilityException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/ValidationException.html b/javadoc/org/owasp/esapi/errors/class-use/ValidationException.html deleted file mode 100644 index cd1f55165..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/ValidationException.html +++ /dev/null @@ -1,728 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.ValidationException
-| -Packages that use ValidationException | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.errors | -A set of exception classes designed to model the error conditions that -frequently arise in enterprise web applications and web services. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of ValidationException in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return ValidationException | -|
- ValidationException |
-ValidationErrorList.getError(java.lang.String context)
-
-- Retrieves ValidationException for given context if one exists. |
-
- -
| Methods in org.owasp.esapi with parameters of type ValidationException | -|
- void |
-ValidationErrorList.addError(java.lang.String context,
- ValidationException ve)
-
-- Adds a new error to list with a unique named context. |
-
- -
| Methods in org.owasp.esapi that throw ValidationException | -|
- java.lang.String |
-Validator.getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated input as a String. |
-
- java.util.Date |
-Validator.getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns a valid date as a Date. |
-
- java.lang.String |
-Validator.getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated "safe" HTML. |
-
- java.lang.String |
-Validator.getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- java.lang.String |
-Validator.getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- java.lang.String |
-Validator.getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated file name as a String. |
-
- java.lang.Double |
-Validator.getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double within the range of minValue to maxValue. |
-
- java.lang.Integer |
-Validator.getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns a validated integer. |
-
- java.lang.Double |
-Validator.getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns a validated real number as a double. |
-
- byte[] |
-Validator.getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns validated file content as a byte array. |
-
- void |
-Validator.assertValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Validates the filepath, filename, and content of a file. |
-
- void |
-Validator.assertIsValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- java.lang.String |
-Validator.getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- void |
-Validator.assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- byte[] |
-Validator.getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a byte array. |
-
- java.lang.String |
-Validator.getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a String. |
-
- java.lang.String |
-Validator.getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated redirect location as a String. |
-
- java.lang.String |
-Validator.safeReadLine(java.io.InputStream inputStream,
- int maxLength)
-
-- Reads from an input stream until end-of-line or a maximum number of - characters. |
-
- java.util.List |
-HTTPUtilities.getSafeFileUploads(javax.servlet.http.HttpServletRequest request,
- java.io.File tempDir,
- java.io.File finalDir)
-
-- Extract uploaded files from a multipart HTTP requests. |
-
- -
| Constructors in org.owasp.esapi that throw ValidationException | -|
SafeFile(java.lang.String path)
-
-- |
-|
SafeFile(java.lang.String parent,
- java.lang.String child)
-
-- |
-|
SafeFile(java.io.File parent,
- java.lang.String child)
-
-- |
-|
SafeFile(java.net.URI uri)
-
-- |
-|
| -Uses of ValidationException in org.owasp.esapi.errors | -
- -
| Subclasses of ValidationException in org.owasp.esapi.errors | -|
- class |
-ValidationAvailabilityException
-
-- |
-
- class |
-ValidationUploadException
-
-- |
-
| -Uses of ValidationException in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that throw ValidationException | -|
- java.lang.String |
-DefaultValidator.getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Validates data received from the browser and returns a safe version. |
-
- java.util.Date |
-DefaultValidator.getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- |
-
- java.lang.String |
-DefaultValidator.getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- |
-
- java.lang.String |
-DefaultValidator.getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- java.lang.String |
-DefaultValidator.getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- java.lang.String |
-DefaultValidator.getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated file name as a String. |
-
- java.lang.Double |
-DefaultValidator.getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- java.lang.Double |
-DefaultValidator.getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- java.lang.Integer |
-DefaultValidator.getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- byte[] |
-DefaultValidator.getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns validated file content as a byte array. |
-
- void |
-DefaultValidator.assertValidFileUpload(java.lang.String context,
- java.lang.String directorypath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Validates the filepath, filename, and content of a file. |
-
- void |
-DefaultValidator.assertIsValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- java.lang.String |
-DefaultValidator.getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- void |
-DefaultValidator.assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- byte[] |
-DefaultValidator.getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a byte array. |
-
- java.lang.String |
-DefaultValidator.getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a String. |
-
- java.lang.String |
-DefaultValidator.getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated redirect location as a String. |
-
- java.lang.String |
-DefaultValidator.safeReadLine(java.io.InputStream in,
- int max)
-
-- This implementation reads until a newline or the specified number of - characters. |
-
- java.util.List |
-DefaultHTTPUtilities.getSafeFileUploads(javax.servlet.http.HttpServletRequest request,
- java.io.File tempDir,
- java.io.File finalDir)
-
-- Uses the Apache Commons FileUploader to parse the multipart HTTP request - and extract any files therein. |
-
- void |
-LoggerTest.testLogHTTPRequest()
-
-- Test of logHTTPRequest method, of class org.owasp.esapi.Logger. |
-
- void |
-HTTPUtilitiesTest.testSendSafeRedirect()
-
-- Test of sendRedirect method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-EncoderTest.testNormalize()
-
-- Test of normalize method, of class org.owasp.esapi.Validator. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/class-use/ValidationUploadException.html b/javadoc/org/owasp/esapi/errors/class-use/ValidationUploadException.html deleted file mode 100644 index e7b4055cc..000000000 --- a/javadoc/org/owasp/esapi/errors/class-use/ValidationUploadException.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.errors.ValidationUploadException
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/package-frame.html b/javadoc/org/owasp/esapi/errors/package-frame.html deleted file mode 100644 index c871df42e..000000000 --- a/javadoc/org/owasp/esapi/errors/package-frame.html +++ /dev/null @@ -1,75 +0,0 @@ - - - - - -
|
-Classes
-
- -EnterpriseSecurityExceptionTest |
-
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Package org.owasp.esapi.errors -
-A set of exception classes designed to model the error conditions that -frequently arise in enterprise web applications and web services. -
-See:
-
- Description
-
- -
| -Class Summary | -|
| EnterpriseSecurityExceptionTest | -The Class AccessReferenceMapTest. | -
- -
| -Exception Summary | -|
| AccessControlException | -An AccessControlException should be thrown when a user attempts to access a - resource that they are not authorized for. | -
| AuthenticationAccountsException | -An AuthenticationException should be thrown when anything goes wrong during - login or logout. | -
| AuthenticationCredentialsException | -An AuthenticationException should be thrown when anything goes wrong during - login or logout. | -
| AuthenticationException | -An AuthenticationException should be thrown when anything goes wrong during - login or logout. | -
| AuthenticationHostException | -An AuthenticationHostException should be thrown when there is a problem with - the host involved with authentication, particularly if the host changes unexpectedly. | -
| AuthenticationLoginException | -An AuthenticationException should be thrown when anything goes wrong during - login or logout. | -
| AvailabilityException | -An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy. | -
| CertificateException | -A CertificateException should be thrown for any problems that arise during - processing of digital certificates. | -
| EncodingException | -An ExecutorException should be thrown for any problems that occur when - encoding or decoding data. | -
| EncryptionException | -An EncryptionException should be thrown for any problems related to - encryption, hashing, or digital signatures. | -
| EnterpriseSecurityException | -EnterpriseSecurityException is the base class for all security related exceptions. | -
| ExecutorException | -An ExecutorException should be thrown for any problems that arise during the - execution of a system executable. | -
| IntegrityException | -An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy. | -
| IntrusionException | -An IntrusionException should be thrown anytime an error condition arises that is likely to be the result of an attack - in progress. | -
| ValidationAvailabilityException | -- |
| ValidationException | -A ValidationException should be thrown to indicate that the data provided by - the user or from some other external source does not match the validation - rules that have been specified for that data. | -
| ValidationUploadException | -- |
-Package org.owasp.esapi.errors Description -
- --A set of exception classes designed to model the error conditions that -frequently arise in enterprise web applications and web services. The -root class is the EnterpriseSecurityException and all the other -exception classes extend this basic class. The -EnterpriseSecurityException automatically logs a message in the -constructor so that a full set of security events are captured in the -logs. -
- -
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/package-tree.html b/javadoc/org/owasp/esapi/errors/package-tree.html deleted file mode 100644 index cd4f1114c..000000000 --- a/javadoc/org/owasp/esapi/errors/package-tree.html +++ /dev/null @@ -1,163 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Hierarchy For Package org.owasp.esapi.errors -
--
-
- Package Hierarchies:
- All Packages
-
-Class Hierarchy -
--
-
- class java.lang.Object
-
-
- class junit.framework.Assert
-
-
- class junit.framework.TestCase (implements junit.framework.Test)
-
-
-
- class org.owasp.esapi.errors.EnterpriseSecurityExceptionTest
- class junit.framework.TestCase (implements junit.framework.Test)
-
- class java.lang.Throwable (implements java.io.Serializable)
-
-
-
- class java.lang.Exception
-
-
- class org.owasp.esapi.errors.EnterpriseSecurityException
-
-
- class org.owasp.esapi.errors.AccessControlException
- class org.owasp.esapi.errors.AuthenticationException
-
-
- class org.owasp.esapi.errors.AuthenticationAccountsException
- class org.owasp.esapi.errors.AuthenticationCredentialsException
- class org.owasp.esapi.errors.AuthenticationHostException
- class org.owasp.esapi.errors.AuthenticationLoginException
- class org.owasp.esapi.errors.AvailabilityException
- class org.owasp.esapi.errors.CertificateException
- class org.owasp.esapi.errors.EncodingException
- class org.owasp.esapi.errors.EncryptionException
- class org.owasp.esapi.errors.ExecutorException
- class org.owasp.esapi.errors.IntegrityException
- class org.owasp.esapi.errors.ValidationException
-
-
- class org.owasp.esapi.errors.ValidationAvailabilityException
- class org.owasp.esapi.errors.ValidationUploadException
- class java.lang.RuntimeException
-
-
- class org.owasp.esapi.errors.IntrusionException
- class org.owasp.esapi.errors.EnterpriseSecurityException
- class java.lang.Exception
- class junit.framework.Assert
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/errors/package-use.html b/javadoc/org/owasp/esapi/errors/package-use.html deleted file mode 100644 index db60d0a5a..000000000 --- a/javadoc/org/owasp/esapi/errors/package-use.html +++ /dev/null @@ -1,325 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Package
org.owasp.esapi.errors
-| -Packages that use org.owasp.esapi.errors | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.errors | -A set of exception classes designed to model the error conditions that -frequently arise in enterprise web applications and web services. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Classes in org.owasp.esapi.errors used by org.owasp.esapi | -|
| AccessControlException
-
- - An AccessControlException should be thrown when a user attempts to access a - resource that they are not authorized for. |
-|
| AuthenticationException
-
- - An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-|
| EncodingException
-
- - An ExecutorException should be thrown for any problems that occur when - encoding or decoding data. |
-|
| EncryptionException
-
- - An EncryptionException should be thrown for any problems related to - encryption, hashing, or digital signatures. |
-|
| ExecutorException
-
- - An ExecutorException should be thrown for any problems that arise during the - execution of a system executable. |
-|
| IntegrityException
-
- - An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy. |
-|
| IntrusionException
-
- - An IntrusionException should be thrown anytime an error condition arises that is likely to be the result of an attack - in progress. |
-|
| ValidationException
-
- - A ValidationException should be thrown to indicate that the data provided by - the user or from some other external source does not match the validation - rules that have been specified for that data. |
-|
| -Classes in org.owasp.esapi.errors used by org.owasp.esapi.errors | -|
| AuthenticationException
-
- - An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-|
| EnterpriseSecurityException
-
- - EnterpriseSecurityException is the base class for all security related exceptions. |
-|
| ValidationException
-
- - A ValidationException should be thrown to indicate that the data provided by - the user or from some other external source does not match the validation - rules that have been specified for that data. |
-|
| -Classes in org.owasp.esapi.errors used by org.owasp.esapi.reference | -|
| AccessControlException
-
- - An AccessControlException should be thrown when a user attempts to access a - resource that they are not authorized for. |
-|
| AuthenticationException
-
- - An AuthenticationException should be thrown when anything goes wrong during - login or logout. |
-|
| EncodingException
-
- - An ExecutorException should be thrown for any problems that occur when - encoding or decoding data. |
-|
| EncryptionException
-
- - An EncryptionException should be thrown for any problems related to - encryption, hashing, or digital signatures. |
-|
| EnterpriseSecurityException
-
- - EnterpriseSecurityException is the base class for all security related exceptions. |
-|
| ExecutorException
-
- - An ExecutorException should be thrown for any problems that arise during the - execution of a system executable. |
-|
| IntegrityException
-
- - An AvailabilityException should be thrown when the availability of a limited - resource is in jeopardy. |
-|
| IntrusionException
-
- - An IntrusionException should be thrown anytime an error condition arises that is likely to be the result of an attack - in progress. |
-|
| ValidationException
-
- - A ValidationException should be thrown to indicate that the data provided by - the user or from some other external source does not match the validation - rules that have been specified for that data. |
-|
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/ESAPIFilter.html b/javadoc/org/owasp/esapi/filters/ESAPIFilter.html deleted file mode 100644 index c56c6f597..000000000 --- a/javadoc/org/owasp/esapi/filters/ESAPIFilter.html +++ /dev/null @@ -1,331 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.filters
-
-Class ESAPIFilter
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.Filter -
-
-
-
- public class ESAPIFilter
- extends java.lang.Object
- implements javax.servlet.Filter
- extends java.lang.Object
-
- -
| -Constructor Summary | -|
ESAPIFilter()
-
-- |
-|
| -Method Summary | -|
- void |
-destroy()
-
-- Called by the web container to indicate to a filter that it is being - taken out of service. |
-
- void |
-doFilter(javax.servlet.ServletRequest req,
- javax.servlet.ServletResponse resp,
- javax.servlet.FilterChain chain)
-
-- The doFilter method of the Filter is called by the container each time a - request/response pair is passed through the chain due to a client request - for a resource at the end of the chain. |
-
- void |
-init(javax.servlet.FilterConfig filterConfig)
-
-- Called by the web container to indicate to a filter that it is being - placed into service. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-ESAPIFilter
--public ESAPIFilter()-
-
-
| -Method Detail | -
-init
--public void init(javax.servlet.FilterConfig filterConfig)-
-
-
- Called by the web container to indicate to a filter that it is being
- placed into service. The servlet container calls the init method exactly
- once after instantiating the filter. The init method must complete
- successfully before the filter is asked to do any filtering work.
-
-
-
-
- Specified by:
initin interfacejavax.servlet.Filter
-
-
- Parameters:
filterConfig- configuration object
- -
-doFilter
--public void doFilter(javax.servlet.ServletRequest req, - javax.servlet.ServletResponse resp, - javax.servlet.FilterChain chain) - throws java.io.IOException-
-
-
- The doFilter method of the Filter is called by the container each time a
- request/response pair is passed through the chain due to a client request
- for a resource at the end of the chain. The FilterChain passed in to this
- method allows the Filter to pass on the request and response to the next
- entity in the chain.
-
-
-
-
- Specified by:
doFilterin interfacejavax.servlet.Filter
-
-
- Parameters:
chain- current FilterChain -- Throws: -
java.io.IOException- if any occurs -javax.servlet.ServletException
- -
-destroy
--public void destroy()-
-
-
- Called by the web container to indicate to a filter that it is being
- taken out of service. This method is only called once all threads within
- the filter's doFilter method have exited or after a timeout period has
- passed. After the web container calls this method, it will not call the
- doFilter method again on this instance of the filter.
-
-
-
-
- Specified by:
destroyin interfacejavax.servlet.Filter
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/ESAPIFilterTest.html b/javadoc/org/owasp/esapi/filters/ESAPIFilterTest.html deleted file mode 100644 index 0e3c5fea0..000000000 --- a/javadoc/org/owasp/esapi/filters/ESAPIFilterTest.html +++ /dev/null @@ -1,313 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.filters
-
-Class ESAPIFilterTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class ESAPIFilterTest
- extends junit.framework.TestCase
-The Class AccessReferenceMapTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
ESAPIFilterTest(java.lang.String testName)
-
-- Instantiates a new access reference map test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testFilter()
-
-- Test of update method, of class org.owasp.esapi.AccessReferenceMap. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ESAPIFilterTest
--public ESAPIFilterTest(java.lang.String testName)-
-
-
- Instantiates a new access reference map test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testFilter
--public void testFilter() - throws java.lang.Exception-
-
-
- Test of update method, of class org.owasp.esapi.AccessReferenceMap.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception -java.lang.Exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/SafeHTTPFilter.html b/javadoc/org/owasp/esapi/filters/SafeHTTPFilter.html deleted file mode 100644 index 3ba2d66b5..000000000 --- a/javadoc/org/owasp/esapi/filters/SafeHTTPFilter.html +++ /dev/null @@ -1,324 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.filters
-
-Class SafeHTTPFilter
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.Filter -
-
-
-
- public class SafeHTTPFilter
- extends java.lang.Object
- implements javax.servlet.Filter
- extends java.lang.Object
-This filter wraps the incoming request and outgoing response and overrides - many methods with safer versions. Many of the safer versions simply validate - parts of the request or response for unwanted characters before allowing the - call to complete. Some examples of attacks that use these - vectors include request splitting, response splitting, and file download - injection. Attackers use techniques like CRLF injection and null byte injection - to confuse the parsing of requests and responses. -
- -
-
- -
| -Constructor Summary | -|
SafeHTTPFilter()
-
-- |
-|
| -Method Summary | -|
- void |
-destroy()
-
-- |
-
- void |
-doFilter(javax.servlet.ServletRequest request,
- javax.servlet.ServletResponse response,
- javax.servlet.FilterChain chain)
-
-- |
-
- void |
-init(javax.servlet.FilterConfig filterConfig)
-
-- |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-SafeHTTPFilter
--public SafeHTTPFilter()-
-
-
| -Method Detail | -
-doFilter
--public void doFilter(javax.servlet.ServletRequest request, - javax.servlet.ServletResponse response, - javax.servlet.FilterChain chain) - throws java.io.IOException, - javax.servlet.ServletException-
-
-
-
-
- Specified by:
doFilterin interfacejavax.servlet.Filter
--
-
-
- Throws: -
java.io.IOException-javax.servlet.ServletException
-
- -
-destroy
--public void destroy()-
-
-
-
-
- Specified by:
destroyin interfacejavax.servlet.Filter
--
-
-
- -
-init
--public void init(javax.servlet.FilterConfig filterConfig) - throws javax.servlet.ServletException-
-
-
-
-
- Specified by:
initin interfacejavax.servlet.Filter
--
-
-
- Throws: -
javax.servlet.ServletException
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/SafeHeaderFilter.html b/javadoc/org/owasp/esapi/filters/SafeHeaderFilter.html deleted file mode 100644 index bb9217a6f..000000000 --- a/javadoc/org/owasp/esapi/filters/SafeHeaderFilter.html +++ /dev/null @@ -1,323 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.filters
-
-Class SafeHeaderFilter
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.Filter -
-
-
-
- public class SafeHeaderFilter
- extends java.lang.Object
- implements javax.servlet.Filter
- extends java.lang.Object
-This filter wraps the incoming request and outgoing response and overrides - several of the methods with versions that protect against unsafe characters - in request and response headers. Some examples of attacks that use these - vectors include request splitting, response splitting, and file download - injection. Attackers use techniques like CRLF injection and null byte injection - to confuse the parsing of requests and responses. -
- -
-
- -
| -Constructor Summary | -|
SafeHeaderFilter()
-
-- |
-|
| -Method Summary | -|
- void |
-destroy()
-
-- |
-
- void |
-doFilter(javax.servlet.ServletRequest request,
- javax.servlet.ServletResponse response,
- javax.servlet.FilterChain chain)
-
-- |
-
- void |
-init(javax.servlet.FilterConfig filterConfig)
-
-- |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-SafeHeaderFilter
--public SafeHeaderFilter()-
-
-
| -Method Detail | -
-doFilter
--public void doFilter(javax.servlet.ServletRequest request, - javax.servlet.ServletResponse response, - javax.servlet.FilterChain chain) - throws java.io.IOException, - javax.servlet.ServletException-
-
-
-
-
- Specified by:
doFilterin interfacejavax.servlet.Filter
--
-
-
- Throws: -
java.io.IOException-javax.servlet.ServletException
-
- -
-destroy
--public void destroy()-
-
-
-
-
- Specified by:
destroyin interfacejavax.servlet.Filter
--
-
-
- -
-init
--public void init(javax.servlet.FilterConfig filterConfig) - throws javax.servlet.ServletException-
-
-
-
-
- Specified by:
initin interfacejavax.servlet.Filter
--
-
-
- Throws: -
javax.servlet.ServletException
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/SafeRequest.html b/javadoc/org/owasp/esapi/filters/SafeRequest.html deleted file mode 100644 index 71f68ab14..000000000 --- a/javadoc/org/owasp/esapi/filters/SafeRequest.html +++ /dev/null @@ -1,1614 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.filters
-
-Class SafeRequest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.http.HttpServletRequest, javax.servlet.ServletRequest -
-
-
-
- public class SafeRequest
- extends java.lang.Object
- implements javax.servlet.http.HttpServletRequest
- extends java.lang.Object
-This request wrapper simply overrides unsafe methods in the HttpServletRequest - API with safe versions that return canonicalized data where possible. The wrapper - returns a safe value when a validation error is detected, including stripped or - empty strings. -
- -
-
- -
| -Field Summary | -
| Fields inherited from interface javax.servlet.http.HttpServletRequest | -
BASIC_AUTH, CLIENT_CERT_AUTH, DIGEST_AUTH, FORM_AUTH |
-
| -Constructor Summary | -|
SafeRequest(javax.servlet.http.HttpServletRequest request)
-
-- Construct a safe request that overrides the default request methods with safer versions. |
-|
| -Method Summary | -|
- java.lang.Object |
-getAttribute(java.lang.String name)
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.util.Enumeration |
-getAttributeNames()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getAuthType()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getCharacterEncoding()
-
-- Same as HttpServletRequest, no security changes required. |
-
- int |
-getContentLength()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getContentType()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getContextPath()
-
-- Returns the context path from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- javax.servlet.http.Cookie[] |
-getCookies()
-
-- Returns the array of Cookies from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- long |
-getDateHeader(java.lang.String name)
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getHeader(java.lang.String name)
-
-- Returns the named header from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- java.util.Enumeration |
-getHeaderNames()
-
-- Returns the enumeration of header names from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- java.util.Enumeration |
-getHeaders(java.lang.String name)
-
-- Returns the enumeration of headers from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- javax.servlet.ServletInputStream |
-getInputStream()
-
-- Same as HttpServletRequest, no security changes required. |
-
- int |
-getIntHeader(java.lang.String name)
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getLocalAddr()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.util.Locale |
-getLocale()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.util.Enumeration |
-getLocales()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getLocalName()
-
-- Same as HttpServletRequest, no security changes required. |
-
- int |
-getLocalPort()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getMethod()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getParameter(java.lang.String name)
-
-- Returns the named parameter from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- java.util.Map |
-getParameterMap()
-
-- Returns the parameter map from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- java.util.Enumeration |
-getParameterNames()
-
-- Returns the enumeration of parameter names from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- java.lang.String[] |
-getParameterValues(java.lang.String name)
-
-- Returns the array of matching parameter values from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- java.lang.String |
-getPathInfo()
-
-- Returns the path info from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- java.lang.String |
-getPathTranslated()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getProtocol()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getQueryString()
-
-- Returns the query string from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- java.io.BufferedReader |
-getReader()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getRealPath(java.lang.String path)
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getRemoteAddr()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getRemoteHost()
-
-- Same as HttpServletRequest, no security changes required. |
-
- int |
-getRemotePort()
-
-- Same as HttpServletRequest, no security changes required. |
-
- java.lang.String |
-getRemoteUser()
-
-- Returns the name of the ESAPI user associated with this request. |
-
- javax.servlet.RequestDispatcher |
-getRequestDispatcher(java.lang.String path)
-
-- Checks to make sure the path to forward to is within the WEB-INF directory - and then returns the dispatcher. |
-
- java.lang.String |
-getRequestedSessionId()
-
-- Returns the URI from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- java.lang.String |
-getRequestURI()
-
-- Returns the URI from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- java.lang.StringBuffer |
-getRequestURL()
-
-- Returns the URL from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- java.lang.String |
-getScheme()
-
-- Returns the scheme from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- java.lang.String |
-getServerName()
-
-- Returns the server name (host header) from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- int |
-getServerPort()
-
-- Returns the server port (after the : in the host header) from the HttpServletRequest after - parsing and checking the range 0-65536. |
-
- java.lang.String |
-getServletPath()
-
-- Returns the server path from the HttpServletRequest after - canonicalizing and filtering out any dangerous characters. |
-
- javax.servlet.http.HttpSession |
-getSession()
-
-- Returns a session, creating it if necessary, and sets the HttpOnly flag on the JSESSIONID cookie. |
-
- javax.servlet.http.HttpSession |
-getSession(boolean create)
-
-- Returns a session, creating it if necessary, and sets the HttpOnly flag on the JSESSIONID cookie. |
-
- java.security.Principal |
-getUserPrincipal()
-
-- Returns the ESAPI User associated with this request. |
-
- boolean |
-isRequestedSessionIdFromCookie()
-
-- Same as HttpServletRequest, no security changes required. |
-
- boolean |
-isRequestedSessionIdFromUrl()
-
-- Same as HttpServletRequest, no security changes required. |
-
- boolean |
-isRequestedSessionIdFromURL()
-
-- Same as HttpServletRequest, no security changes required. |
-
- boolean |
-isRequestedSessionIdValid()
-
-- Same as HttpServletRequest, no security changes required. |
-
- boolean |
-isSecure()
-
-- Same as HttpServletRequest, no security changes required. |
-
- boolean |
-isUserInRole(java.lang.String role)
-
-- Returns true if the ESAPI User associated with this request has the specified role. |
-
- void |
-removeAttribute(java.lang.String name)
-
-- Same as HttpServletRequest, no security changes required. |
-
- void |
-setAttribute(java.lang.String name,
- java.lang.Object o)
-
-- Same as HttpServletRequest, no security changes required. |
-
- void |
-setCharacterEncoding(java.lang.String enc)
-
-- Sets the character encoding to the ESAPI configured encoding. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-SafeRequest
--public SafeRequest(javax.servlet.http.HttpServletRequest request)-
-
-
- Construct a safe request that overrides the default request methods with safer versions.
-
-
- Parameters:
request-
| -Method Detail | -
-getAttribute
--public java.lang.Object getAttribute(java.lang.String name)-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getAttributein interfacejavax.servlet.ServletRequest
-
-
- -
-getAttributeNames
--public java.util.Enumeration getAttributeNames()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getAttributeNamesin interfacejavax.servlet.ServletRequest
-
-
- -
-getAuthType
--public java.lang.String getAuthType()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getAuthTypein interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getCharacterEncoding
--public java.lang.String getCharacterEncoding()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getCharacterEncodingin interfacejavax.servlet.ServletRequest
-
-
- -
-getContentLength
--public int getContentLength()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getContentLengthin interfacejavax.servlet.ServletRequest
-
-
- -
-getContentType
--public java.lang.String getContentType()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getContentTypein interfacejavax.servlet.ServletRequest
-
-
- -
-getContextPath
--public java.lang.String getContextPath()-
-
-
- Returns the context path from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getContextPathin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getCookies
--public javax.servlet.http.Cookie[] getCookies()-
-
-
- Returns the array of Cookies from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getCookiesin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getDateHeader
--public long getDateHeader(java.lang.String name)-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getDateHeaderin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getHeader
--public java.lang.String getHeader(java.lang.String name)-
-
-
- Returns the named header from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getHeaderin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getHeaderNames
--public java.util.Enumeration getHeaderNames()-
-
-
- Returns the enumeration of header names from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getHeaderNamesin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getHeaders
--public java.util.Enumeration getHeaders(java.lang.String name)-
-
-
- Returns the enumeration of headers from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getHeadersin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getInputStream
--public javax.servlet.ServletInputStream getInputStream() - throws java.io.IOException-
-
-
- Same as HttpServletRequest, no security changes required.
- Note that this input stream may contain attacks and the
- developer is responsible for canonicalizing, validating,
- and encoding any data from this stream.
-
-
-
-
- Specified by:
getInputStreamin interfacejavax.servlet.ServletRequest
-
-
-
- Throws: -
java.io.IOException
- -
-getIntHeader
--public int getIntHeader(java.lang.String name)-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getIntHeaderin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getLocalAddr
--public java.lang.String getLocalAddr()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getLocalAddrin interfacejavax.servlet.ServletRequest
-
-
- -
-getLocale
--public java.util.Locale getLocale()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getLocalein interfacejavax.servlet.ServletRequest
-
-
- -
-getLocales
--public java.util.Enumeration getLocales()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getLocalesin interfacejavax.servlet.ServletRequest
-
-
- -
-getLocalName
--public java.lang.String getLocalName()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getLocalNamein interfacejavax.servlet.ServletRequest
-
-
- -
-getLocalPort
--public int getLocalPort()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getLocalPortin interfacejavax.servlet.ServletRequest
-
-
- -
-getMethod
--public java.lang.String getMethod()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getMethodin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getParameter
--public java.lang.String getParameter(java.lang.String name)-
-
-
- Returns the named parameter from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getParameterin interfacejavax.servlet.ServletRequest
-
-
- -
-getParameterMap
--public java.util.Map getParameterMap()-
-
-
- Returns the parameter map from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getParameterMapin interfacejavax.servlet.ServletRequest
-
-
- -
-getParameterNames
--public java.util.Enumeration getParameterNames()-
-
-
- Returns the enumeration of parameter names from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getParameterNamesin interfacejavax.servlet.ServletRequest
-
-
- -
-getParameterValues
--public java.lang.String[] getParameterValues(java.lang.String name)-
-
-
- Returns the array of matching parameter values from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getParameterValuesin interfacejavax.servlet.ServletRequest
-
-
- -
-getPathInfo
--public java.lang.String getPathInfo()-
-
-
- Returns the path info from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getPathInfoin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getPathTranslated
--public java.lang.String getPathTranslated()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getPathTranslatedin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getProtocol
--public java.lang.String getProtocol()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getProtocolin interfacejavax.servlet.ServletRequest
-
-
- -
-getQueryString
--public java.lang.String getQueryString()-
-
-
- Returns the query string from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getQueryStringin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getReader
--public java.io.BufferedReader getReader() - throws java.io.IOException-
-
-
- Same as HttpServletRequest, no security changes required.
- Note that this reader may contain attacks and the
- developer is responsible for canonicalizing, validating,
- and encoding any data from this stream.
-
-
-
-
- Specified by:
getReaderin interfacejavax.servlet.ServletRequest
-
-
-
- Throws: -
java.io.IOException
- -
-getRealPath
--public java.lang.String getRealPath(java.lang.String path)-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getRealPathin interfacejavax.servlet.ServletRequest
-
-
- -
-getRemoteAddr
--public java.lang.String getRemoteAddr()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getRemoteAddrin interfacejavax.servlet.ServletRequest
-
-
- -
-getRemoteHost
--public java.lang.String getRemoteHost()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getRemoteHostin interfacejavax.servlet.ServletRequest
-
-
- -
-getRemotePort
--public int getRemotePort()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
getRemotePortin interfacejavax.servlet.ServletRequest
-
-
- -
-getRemoteUser
--public java.lang.String getRemoteUser()-
-
-
- Returns the name of the ESAPI user associated with this request.
-
-
-
-
- Specified by:
getRemoteUserin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getRequestDispatcher
--public javax.servlet.RequestDispatcher getRequestDispatcher(java.lang.String path)-
-
-
- Checks to make sure the path to forward to is within the WEB-INF directory
- and then returns the dispatcher. Otherwise returns null.
-
-
-
-
- Specified by:
getRequestDispatcherin interfacejavax.servlet.ServletRequest
-
-
- -
-getRequestedSessionId
--public java.lang.String getRequestedSessionId()-
-
-
- Returns the URI from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
- Code must be very careful not to depend on the value of a requested session id
- reported by the user.
-
-
-
-
- Specified by:
getRequestedSessionIdin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getRequestURI
--public java.lang.String getRequestURI()-
-
-
- Returns the URI from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getRequestURIin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getRequestURL
--public java.lang.StringBuffer getRequestURL()-
-
-
- Returns the URL from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getRequestURLin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getScheme
--public java.lang.String getScheme()-
-
-
- Returns the scheme from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getSchemein interfacejavax.servlet.ServletRequest
-
-
- -
-getServerName
--public java.lang.String getServerName()-
-
-
- Returns the server name (host header) from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getServerNamein interfacejavax.servlet.ServletRequest
-
-
- -
-getServerPort
--public int getServerPort()-
-
-
- Returns the server port (after the : in the host header) from the HttpServletRequest after
- parsing and checking the range 0-65536.
-
-
-
-
- Specified by:
getServerPortin interfacejavax.servlet.ServletRequest
-
-
- -
-getServletPath
--public java.lang.String getServletPath()-
-
-
- Returns the server path from the HttpServletRequest after
- canonicalizing and filtering out any dangerous characters.
-
-
-
-
- Specified by:
getServletPathin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getSession
--public javax.servlet.http.HttpSession getSession()-
-
-
- Returns a session, creating it if necessary, and sets the HttpOnly flag on the JSESSIONID cookie.
-
-
-
-
- Specified by:
getSessionin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getSession
--public javax.servlet.http.HttpSession getSession(boolean create)-
-
-
- Returns a session, creating it if necessary, and sets the HttpOnly flag on the JSESSIONID cookie.
-
-
-
-
- Specified by:
getSessionin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-getUserPrincipal
--public java.security.Principal getUserPrincipal()-
-
-
- Returns the ESAPI User associated with this request.
-
-
-
-
- Specified by:
getUserPrincipalin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-isRequestedSessionIdFromCookie
--public boolean isRequestedSessionIdFromCookie()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
isRequestedSessionIdFromCookiein interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-isRequestedSessionIdFromUrl
--public boolean isRequestedSessionIdFromUrl()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
isRequestedSessionIdFromUrlin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-isRequestedSessionIdFromURL
--public boolean isRequestedSessionIdFromURL()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
isRequestedSessionIdFromURLin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-isRequestedSessionIdValid
--public boolean isRequestedSessionIdValid()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
isRequestedSessionIdValidin interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-isSecure
--public boolean isSecure()-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
isSecurein interfacejavax.servlet.ServletRequest
-
-
- -
-isUserInRole
--public boolean isUserInRole(java.lang.String role)-
-
-
- Returns true if the ESAPI User associated with this request has the specified role.
-
-
-
-
- Specified by:
isUserInRolein interfacejavax.servlet.http.HttpServletRequest
-
-
- -
-removeAttribute
--public void removeAttribute(java.lang.String name)-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
removeAttributein interfacejavax.servlet.ServletRequest
-
-
- -
-setAttribute
--public void setAttribute(java.lang.String name, - java.lang.Object o)-
-
-
- Same as HttpServletRequest, no security changes required.
-
-
-
-
- Specified by:
setAttributein interfacejavax.servlet.ServletRequest
-
-
- -
-setCharacterEncoding
--public void setCharacterEncoding(java.lang.String enc) - throws java.io.UnsupportedEncodingException-
-
-
- Sets the character encoding to the ESAPI configured encoding.
-
-
-
-
- Specified by:
setCharacterEncodingin interfacejavax.servlet.ServletRequest
-
-
-
- Throws: -
java.io.UnsupportedEncodingException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/SafeResponse.html b/javadoc/org/owasp/esapi/filters/SafeResponse.html deleted file mode 100644 index b04c6b80c..000000000 --- a/javadoc/org/owasp/esapi/filters/SafeResponse.html +++ /dev/null @@ -1,1161 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.filters
-
-Class SafeResponse
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.http.HttpServletResponse, javax.servlet.ServletResponse -
-
-
-
- public class SafeResponse
- extends java.lang.Object
- implements javax.servlet.http.HttpServletResponse
- extends java.lang.Object
-This response wrapper simply overrides unsafe methods in the - HttpServletResponse API with safe versions. -
- -
-
- -
| -Field Summary | -
| Fields inherited from interface javax.servlet.http.HttpServletResponse | -
SC_ACCEPTED, SC_BAD_GATEWAY, SC_BAD_REQUEST, SC_CONFLICT, SC_CONTINUE, SC_CREATED, SC_EXPECTATION_FAILED, SC_FORBIDDEN, SC_FOUND, SC_GATEWAY_TIMEOUT, SC_GONE, SC_HTTP_VERSION_NOT_SUPPORTED, SC_INTERNAL_SERVER_ERROR, SC_LENGTH_REQUIRED, SC_METHOD_NOT_ALLOWED, SC_MOVED_PERMANENTLY, SC_MOVED_TEMPORARILY, SC_MULTIPLE_CHOICES, SC_NO_CONTENT, SC_NON_AUTHORITATIVE_INFORMATION, SC_NOT_ACCEPTABLE, SC_NOT_FOUND, SC_NOT_IMPLEMENTED, SC_NOT_MODIFIED, SC_OK, SC_PARTIAL_CONTENT, SC_PAYMENT_REQUIRED, SC_PRECONDITION_FAILED, SC_PROXY_AUTHENTICATION_REQUIRED, SC_REQUEST_ENTITY_TOO_LARGE, SC_REQUEST_TIMEOUT, SC_REQUEST_URI_TOO_LONG, SC_REQUESTED_RANGE_NOT_SATISFIABLE, SC_RESET_CONTENT, SC_SEE_OTHER, SC_SERVICE_UNAVAILABLE, SC_SWITCHING_PROTOCOLS, SC_TEMPORARY_REDIRECT, SC_UNAUTHORIZED, SC_UNSUPPORTED_MEDIA_TYPE, SC_USE_PROXY |
-
| -Constructor Summary | -|
SafeResponse(javax.servlet.http.HttpServletResponse response)
-
-- Construct a safe response that overrides the default response methods - with safer versions. |
-|
| -Method Summary | -|
- void |
-addCookie(javax.servlet.http.Cookie cookie)
-
-- Add a cookie to the response after ensuring that there are no encoded or - illegal characters in the name and name and value. |
-
- void |
-addCookie(java.lang.String name,
- java.lang.String value,
- int maxAge,
- java.lang.String domain,
- java.lang.String path)
-
-- Add a cookie to the response after ensuring that there are no encoded or - illegal characters in the name and name and value. |
-
- void |
-addDateHeader(java.lang.String name,
- long date)
-
-- Add a cookie to the response after ensuring that there are no encoded or - illegal characters in the name. |
-
- void |
-addHeader(java.lang.String name,
- java.lang.String value)
-
-- Add a header to the response after ensuring that there are no encoded or - illegal characters in the name and name and value. |
-
- void |
-addIntHeader(java.lang.String name,
- int value)
-
-- Add an int header to the response after ensuring that there are no - encoded or illegal characters in the name and name. |
-
- boolean |
-containsHeader(java.lang.String name)
-
-- Same as HttpServletResponse, no security changes required. |
-
- java.lang.String |
-encodeRedirectUrl(java.lang.String url)
-
-- Return the URL without any changes, to prevent disclosure of the - JSESSIONID. |
-
- java.lang.String |
-encodeRedirectURL(java.lang.String url)
-
-- Return the URL without any changes, to prevent disclosure of the - JSESSIONID The default implementation of this method can add the - JSESSIONID to the URL if support for cookies is not detected. |
-
- java.lang.String |
-encodeUrl(java.lang.String url)
-
-- Return the URL without any changes, to prevent disclosure of the - JSESSIONID The default implementation of this method can add the - JSESSIONID to the URL if support for cookies is not detected. |
-
- java.lang.String |
-encodeURL(java.lang.String url)
-
-- Return the URL without any changes, to prevent disclosure of the - JSESSIONID The default implementation of this method can add the - JSESSIONID to the URL if support for cookies is not detected. |
-
- void |
-flushBuffer()
-
-- Same as HttpServletResponse, no security changes required. |
-
- int |
-getBufferSize()
-
-- Same as HttpServletResponse, no security changes required. |
-
- java.lang.String |
-getCharacterEncoding()
-
-- Same as HttpServletResponse, no security changes required. |
-
- java.lang.String |
-getContentType()
-
-- Same as HttpServletResponse, no security changes required. |
-
- java.util.Locale |
-getLocale()
-
-- Same as HttpServletResponse, no security changes required. |
-
- javax.servlet.ServletOutputStream |
-getOutputStream()
-
-- Same as HttpServletResponse, no security changes required. |
-
- java.io.PrintWriter |
-getWriter()
-
-- Same as HttpServletResponse, no security changes required. |
-
- boolean |
-isCommitted()
-
-- Same as HttpServletResponse, no security changes required. |
-
- void |
-reset()
-
-- Same as HttpServletResponse, no security changes required. |
-
- void |
-resetBuffer()
-
-- Same as HttpServletResponse, no security changes required. |
-
- void |
-sendError(int sc)
-
-- Override the error code with a 200 in order to confound attackers using - automated scanners. |
-
- void |
-sendError(int sc,
- java.lang.String msg)
-
-- Override the error code with a 200 in order to confound attackers using - automated scanners. |
-
- void |
-sendRedirect(java.lang.String location)
-
-- This method generates a redirect response that can only be used to redirect the browser to safe locations, - as configured in the ESAPI security configuration. |
-
- void |
-setBufferSize(int size)
-
-- Same as HttpServletResponse, no security changes required. |
-
- void |
-setCharacterEncoding(java.lang.String charset)
-
-- Sets the character encoding to the ESAPI configured encoding. |
-
- void |
-setContentLength(int len)
-
-- Same as HttpServletResponse, no security changes required. |
-
- void |
-setContentType(java.lang.String type)
-
-- Same as HttpServletResponse, no security changes required. |
-
- void |
-setDateHeader(java.lang.String name,
- long date)
-
-- Add a date header to the response after ensuring that there are no - encoded or illegal characters in the name. |
-
- void |
-setHeader(java.lang.String name,
- java.lang.String value)
-
-- Add a header to the response after ensuring that there are no encoded or - illegal characters in the name and value. |
-
- void |
-setIntHeader(java.lang.String name,
- int value)
-
-- Add an int header to the response after ensuring that there are no - encoded or illegal characters in the name. |
-
- void |
-setLocale(java.util.Locale loc)
-
-- Same as HttpServletResponse, no security changes required. |
-
- void |
-setStatus(int sc)
-
-- Override the status code with a 200 in order to confound attackers using - automated scanners. |
-
- void |
-setStatus(int sc,
- java.lang.String sm)
-
-- Override the status code with a 200 in order to confound attackers using - automated scanners. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-SafeResponse
--public SafeResponse(javax.servlet.http.HttpServletResponse response)-
-
-
- Construct a safe response that overrides the default response methods
- with safer versions.
-
-
- Parameters:
response-
| -Method Detail | -
-addCookie
--public void addCookie(javax.servlet.http.Cookie cookie)-
-
-
- Add a cookie to the response after ensuring that there are no encoded or
- illegal characters in the name and name and value. This method also sets
- the secure and HttpOnly flags on the cookie.
-
-
-
-
- Specified by:
addCookiein interfacejavax.servlet.http.HttpServletResponse
-
-
- -
-addCookie
--public void addCookie(java.lang.String name, - java.lang.String value, - int maxAge, - java.lang.String domain, - java.lang.String path)-
-
-
- Add a cookie to the response after ensuring that there are no encoded or
- illegal characters in the name and name and value. This method also sets
- the secure and HttpOnly flags on the cookie.
-
-
-
-
-
-
- -
-addDateHeader
--public void addDateHeader(java.lang.String name, - long date)-
-
-
- Add a cookie to the response after ensuring that there are no encoded or
- illegal characters in the name.
-
-
-
-
- Specified by:
addDateHeaderin interfacejavax.servlet.http.HttpServletResponse
-
-
- -
-addHeader
--public void addHeader(java.lang.String name, - java.lang.String value)-
-
-
- Add a header to the response after ensuring that there are no encoded or
- illegal characters in the name and name and value. This implementation
- follows the following recommendation: "A recipient MAY replace any linear
- white space with a single SP before interpreting the field value or
- forwarding the message downstream."
- http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2
-
-
-
-
- Specified by:
addHeaderin interfacejavax.servlet.http.HttpServletResponse
-
-
- -
-addIntHeader
--public void addIntHeader(java.lang.String name, - int value)-
-
-
- Add an int header to the response after ensuring that there are no
- encoded or illegal characters in the name and name.
-
-
-
-
- Specified by:
addIntHeaderin interfacejavax.servlet.http.HttpServletResponse
-
-
- -
-containsHeader
--public boolean containsHeader(java.lang.String name)-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
containsHeaderin interfacejavax.servlet.http.HttpServletResponse
-
-
- -
-encodeRedirectUrl
--public java.lang.String encodeRedirectUrl(java.lang.String url)-
-
-
- Return the URL without any changes, to prevent disclosure of the
- JSESSIONID. The default implementation of this method can add the
- JSESSIONID to the URL if support for cookies is not detected. This
- exposes the JSESSIONID credential in bookmarks, referer headers, server
- logs, and more.
-
-
-
-
- Specified by:
encodeRedirectUrlin interfacejavax.servlet.http.HttpServletResponse
-
-
- Parameters:
url- -- Returns:
- original url
- -
-encodeRedirectURL
--public java.lang.String encodeRedirectURL(java.lang.String url)-
-
-
- Return the URL without any changes, to prevent disclosure of the
- JSESSIONID The default implementation of this method can add the
- JSESSIONID to the URL if support for cookies is not detected. This
- exposes the JSESSIONID credential in bookmarks, referer headers, server
- logs, and more.
-
-
-
-
- Specified by:
encodeRedirectURLin interfacejavax.servlet.http.HttpServletResponse
-
-
- Parameters:
url- -- Returns:
- original url
- -
-encodeUrl
--public java.lang.String encodeUrl(java.lang.String url)-
-
-
- Return the URL without any changes, to prevent disclosure of the
- JSESSIONID The default implementation of this method can add the
- JSESSIONID to the URL if support for cookies is not detected. This
- exposes the JSESSIONID credential in bookmarks, referer headers, server
- logs, and more.
-
-
-
-
- Specified by:
encodeUrlin interfacejavax.servlet.http.HttpServletResponse
-
-
- Parameters:
url- -- Returns:
- original url
- -
-encodeURL
--public java.lang.String encodeURL(java.lang.String url)-
-
-
- Return the URL without any changes, to prevent disclosure of the
- JSESSIONID The default implementation of this method can add the
- JSESSIONID to the URL if support for cookies is not detected. This
- exposes the JSESSIONID credential in bookmarks, referer headers, server
- logs, and more.
-
-
-
-
- Specified by:
encodeURLin interfacejavax.servlet.http.HttpServletResponse
-
-
- Parameters:
url- -- Returns:
- original url
- -
-flushBuffer
--public void flushBuffer() - throws java.io.IOException-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
flushBufferin interfacejavax.servlet.ServletResponse
-
-
-
- Throws: -
java.io.IOException
- -
-getBufferSize
--public int getBufferSize()-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
getBufferSizein interfacejavax.servlet.ServletResponse
-
-
- -
-getCharacterEncoding
--public java.lang.String getCharacterEncoding()-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
getCharacterEncodingin interfacejavax.servlet.ServletResponse
-
-
- -
-getContentType
--public java.lang.String getContentType()-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
getContentTypein interfacejavax.servlet.ServletResponse
-
-
- -
-getLocale
--public java.util.Locale getLocale()-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
getLocalein interfacejavax.servlet.ServletResponse
-
-
- -
-getOutputStream
--public javax.servlet.ServletOutputStream getOutputStream() - throws java.io.IOException-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
getOutputStreamin interfacejavax.servlet.ServletResponse
-
-
-
- Throws: -
java.io.IOException
- -
-getWriter
--public java.io.PrintWriter getWriter() - throws java.io.IOException-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
getWriterin interfacejavax.servlet.ServletResponse
-
-
-
- Throws: -
java.io.IOException
- -
-isCommitted
--public boolean isCommitted()-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
isCommittedin interfacejavax.servlet.ServletResponse
-
-
- -
-reset
--public void reset()-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
resetin interfacejavax.servlet.ServletResponse
-
-
- -
-resetBuffer
--public void resetBuffer()-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
resetBufferin interfacejavax.servlet.ServletResponse
-
-
- -
-sendError
--public void sendError(int sc) - throws java.io.IOException-
-
-
- Override the error code with a 200 in order to confound attackers using
- automated scanners.
-
-
-
-
- Specified by:
sendErrorin interfacejavax.servlet.http.HttpServletResponse
-
-
-
- Throws: -
java.io.IOException
- -
-sendError
--public void sendError(int sc, - java.lang.String msg) - throws java.io.IOException-
-
-
- Override the error code with a 200 in order to confound attackers using
- automated scanners. The message is canonicalized and filtered for
- dangerous characters.
-
-
-
-
- Specified by:
sendErrorin interfacejavax.servlet.http.HttpServletResponse
-
-
-
- Throws: -
java.io.IOException
- -
-sendRedirect
--public void sendRedirect(java.lang.String location) - throws java.io.IOException-
-
-
- This method generates a redirect response that can only be used to redirect the browser to safe locations,
- as configured in the ESAPI security configuration. This method does not that redirect requests can be modified by
- attackers, so do not rely information contained within redirect requests, and do not include sensitive
- information in a redirect.
-
-
-
-
- Specified by:
sendRedirectin interfacejavax.servlet.http.HttpServletResponse
-
-
-
- Throws: -
java.io.IOException
- -
-setBufferSize
--public void setBufferSize(int size)-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
setBufferSizein interfacejavax.servlet.ServletResponse
-
-
- -
-setCharacterEncoding
--public void setCharacterEncoding(java.lang.String charset)-
-
-
- Sets the character encoding to the ESAPI configured encoding.
-
-
-
-
- Specified by:
setCharacterEncodingin interfacejavax.servlet.ServletResponse
-
-
- -
-setContentLength
--public void setContentLength(int len)-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
setContentLengthin interfacejavax.servlet.ServletResponse
-
-
- -
-setContentType
--public void setContentType(java.lang.String type)-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
setContentTypein interfacejavax.servlet.ServletResponse
-
-
- -
-setDateHeader
--public void setDateHeader(java.lang.String name, - long date)-
-
-
- Add a date header to the response after ensuring that there are no
- encoded or illegal characters in the name.
-
-
-
-
- Specified by:
setDateHeaderin interfacejavax.servlet.http.HttpServletResponse
-
-
- -
-setHeader
--public void setHeader(java.lang.String name, - java.lang.String value)-
-
-
- Add a header to the response after ensuring that there are no encoded or
- illegal characters in the name and value.
- "A recipient MAY replace any linear white space with a single SP before
- interpreting the field value or forwarding the message downstream."
- http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2
-
-
-
-
- Specified by:
setHeaderin interfacejavax.servlet.http.HttpServletResponse
-
-
- -
-setIntHeader
--public void setIntHeader(java.lang.String name, - int value)-
-
-
- Add an int header to the response after ensuring that there are no
- encoded or illegal characters in the name.
-
-
-
-
- Specified by:
setIntHeaderin interfacejavax.servlet.http.HttpServletResponse
-
-
- -
-setLocale
--public void setLocale(java.util.Locale loc)-
-
-
- Same as HttpServletResponse, no security changes required.
-
-
-
-
- Specified by:
setLocalein interfacejavax.servlet.ServletResponse
-
-
- -
-setStatus
--public void setStatus(int sc)-
-
-
- Override the status code with a 200 in order to confound attackers using
- automated scanners.
-
-
-
-
- Specified by:
setStatusin interfacejavax.servlet.http.HttpServletResponse
-
-
- -
-setStatus
--public void setStatus(int sc, - java.lang.String sm)-
-
-
- Override the status code with a 200 in order to confound attackers using
- automated scanners. The message is canonicalized and filtered for
- dangerous characters.
-
-
-
-
- Specified by:
setStatusin interfacejavax.servlet.http.HttpServletResponse
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/class-use/ESAPIFilter.html b/javadoc/org/owasp/esapi/filters/class-use/ESAPIFilter.html deleted file mode 100644 index db368dd79..000000000 --- a/javadoc/org/owasp/esapi/filters/class-use/ESAPIFilter.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.filters.ESAPIFilter
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/class-use/ESAPIFilterTest.html b/javadoc/org/owasp/esapi/filters/class-use/ESAPIFilterTest.html deleted file mode 100644 index 929ce817b..000000000 --- a/javadoc/org/owasp/esapi/filters/class-use/ESAPIFilterTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.filters.ESAPIFilterTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/class-use/SafeHTTPFilter.html b/javadoc/org/owasp/esapi/filters/class-use/SafeHTTPFilter.html deleted file mode 100644 index 516544061..000000000 --- a/javadoc/org/owasp/esapi/filters/class-use/SafeHTTPFilter.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.filters.SafeHTTPFilter
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/class-use/SafeHeaderFilter.html b/javadoc/org/owasp/esapi/filters/class-use/SafeHeaderFilter.html deleted file mode 100644 index c0f981b6e..000000000 --- a/javadoc/org/owasp/esapi/filters/class-use/SafeHeaderFilter.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.filters.SafeHeaderFilter
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/class-use/SafeRequest.html b/javadoc/org/owasp/esapi/filters/class-use/SafeRequest.html deleted file mode 100644 index 791b54ec5..000000000 --- a/javadoc/org/owasp/esapi/filters/class-use/SafeRequest.html +++ /dev/null @@ -1,202 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.filters.SafeRequest
-| -Packages that use SafeRequest | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of SafeRequest in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return SafeRequest | -|
- SafeRequest |
-HTTPUtilities.getCurrentRequest()
-
-- Retrieves the current HttpServletRequest |
-
| -Uses of SafeRequest in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that return SafeRequest | -|
- SafeRequest |
-DefaultHTTPUtilities.getCurrentRequest()
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/class-use/SafeResponse.html b/javadoc/org/owasp/esapi/filters/class-use/SafeResponse.html deleted file mode 100644 index aa7042007..000000000 --- a/javadoc/org/owasp/esapi/filters/class-use/SafeResponse.html +++ /dev/null @@ -1,202 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.filters.SafeResponse
-| -Packages that use SafeResponse | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Uses of SafeResponse in org.owasp.esapi | -
- -
| Methods in org.owasp.esapi that return SafeResponse | -|
- SafeResponse |
-HTTPUtilities.getCurrentResponse()
-
-- Retrieves the current HttpServletResponse |
-
| -Uses of SafeResponse in org.owasp.esapi.reference | -
- -
| Methods in org.owasp.esapi.reference that return SafeResponse | -|
- SafeResponse |
-DefaultHTTPUtilities.getCurrentResponse()
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/package-frame.html b/javadoc/org/owasp/esapi/filters/package-frame.html deleted file mode 100644 index 05124cec3..000000000 --- a/javadoc/org/owasp/esapi/filters/package-frame.html +++ /dev/null @@ -1,40 +0,0 @@ - - - - - -
|
-Classes
-
- -ESAPIFilter - -ESAPIFilterTest - -SafeHTTPFilter - -SafeRequest - -SafeResponse |
-
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Package org.owasp.esapi.filters -
- -| -Class Summary | -|
| ESAPIFilter | -- |
| ESAPIFilterTest | -The Class AccessReferenceMapTest. | -
| SafeHTTPFilter | -This filter wraps the incoming request and outgoing response and overrides - many methods with safer versions. | -
| SafeRequest | -This request wrapper simply overrides unsafe methods in the HttpServletRequest - API with safe versions that return canonicalized data where possible. | -
| SafeResponse | -This response wrapper simply overrides unsafe methods in the - HttpServletResponse API with safe versions. | -
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/package-tree.html b/javadoc/org/owasp/esapi/filters/package-tree.html deleted file mode 100644 index 1a784474e..000000000 --- a/javadoc/org/owasp/esapi/filters/package-tree.html +++ /dev/null @@ -1,154 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Hierarchy For Package org.owasp.esapi.filters -
--
-
- Package Hierarchies:
- All Packages
-
-Class Hierarchy -
--
-
- class java.lang.Object
-
-
- class junit.framework.Assert
-
-
- class junit.framework.TestCase (implements junit.framework.Test)
-
-
-
- class org.owasp.esapi.filters.ESAPIFilterTest
- class junit.framework.TestCase (implements junit.framework.Test)
-
- class org.owasp.esapi.filters.ESAPIFilter (implements javax.servlet.Filter) -
- class org.owasp.esapi.filters.SafeHTTPFilter (implements javax.servlet.Filter) -
- class org.owasp.esapi.filters.SafeRequest (implements javax.servlet.http.HttpServletRequest) -
- class org.owasp.esapi.filters.SafeResponse (implements javax.servlet.http.HttpServletResponse) -
- class junit.framework.Assert
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/filters/package-use.html b/javadoc/org/owasp/esapi/filters/package-use.html deleted file mode 100644 index bb5e6eb59..000000000 --- a/javadoc/org/owasp/esapi/filters/package-use.html +++ /dev/null @@ -1,198 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Package
org.owasp.esapi.filters
-| -Packages that use org.owasp.esapi.filters | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Classes in org.owasp.esapi.filters used by org.owasp.esapi | -|
| SafeRequest
-
- - This request wrapper simply overrides unsafe methods in the HttpServletRequest - API with safe versions that return canonicalized data where possible. |
-|
| SafeResponse
-
- - This response wrapper simply overrides unsafe methods in the - HttpServletResponse API with safe versions. |
-|
| -Classes in org.owasp.esapi.filters used by org.owasp.esapi.reference | -|
| SafeRequest
-
- - This request wrapper simply overrides unsafe methods in the HttpServletRequest - API with safe versions that return canonicalized data where possible. |
-|
| SafeResponse
-
- - This response wrapper simply overrides unsafe methods in the - HttpServletResponse API with safe versions. |
-|
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/TestFilterChain.html b/javadoc/org/owasp/esapi/http/TestFilterChain.html deleted file mode 100644 index 08d7f3421..000000000 --- a/javadoc/org/owasp/esapi/http/TestFilterChain.html +++ /dev/null @@ -1,265 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.http
-
-Class TestFilterChain
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.FilterChain -
-
-
-
- public class TestFilterChain
- extends java.lang.Object
- implements javax.servlet.FilterChain
- extends java.lang.Object
-
- -
| -Constructor Summary | -|
TestFilterChain()
-
-- |
-|
| -Method Summary | -|
- void |
-doFilter(javax.servlet.ServletRequest request,
- javax.servlet.ServletResponse response)
-
-- |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-TestFilterChain
--public TestFilterChain()-
-
-
| -Method Detail | -
-doFilter
--public void doFilter(javax.servlet.ServletRequest request, - javax.servlet.ServletResponse response) - throws java.io.IOException, - javax.servlet.ServletException-
-
-
-
-
- Specified by:
doFilterin interfacejavax.servlet.FilterChain
--
-
-
- Throws: -
java.io.IOException-javax.servlet.ServletException
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/TestHttpServletRequest.html b/javadoc/org/owasp/esapi/http/TestHttpServletRequest.html deleted file mode 100644 index f0550ca8a..000000000 --- a/javadoc/org/owasp/esapi/http/TestHttpServletRequest.html +++ /dev/null @@ -1,1688 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.http
-
-Class TestHttpServletRequest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.http.HttpServletRequest, javax.servlet.ServletRequest -
-
-
-
- public class TestHttpServletRequest
- extends java.lang.Object
- implements javax.servlet.http.HttpServletRequest
- extends java.lang.Object
-The Class TestHttpServletRequest. -
- -
-
-
-
- Author: -
- jwilliams -
- -
| -Field Summary | -
| Fields inherited from interface javax.servlet.http.HttpServletRequest | -
BASIC_AUTH, CLIENT_CERT_AUTH, DIGEST_AUTH, FORM_AUTH |
-
| -Constructor Summary | -|
TestHttpServletRequest()
-
-- |
-|
TestHttpServletRequest(java.lang.String uri,
- byte[] body)
-
-- |
-|
| -Method Summary | -|
- void |
-addHeader(java.lang.String name,
- java.lang.String value)
-
-- Adds the header. |
-
- void |
-addParameter(java.lang.String name,
- java.lang.String value)
-
-- Adds the parameter. |
-
- void |
-clearCookies()
-
-- |
-
- java.lang.Object |
-getAttribute(java.lang.String name)
-
-- |
-
- java.util.Enumeration |
-getAttributeNames()
-
-- |
-
- java.lang.String |
-getAuthType()
-
-- |
-
- java.lang.String |
-getCharacterEncoding()
-
-- |
-
- int |
-getContentLength()
-
-- |
-
- java.lang.String |
-getContentType()
-
-- |
-
- java.lang.String |
-getContextPath()
-
-- |
-
- javax.servlet.http.Cookie[] |
-getCookies()
-
-- |
-
- long |
-getDateHeader(java.lang.String name)
-
-- |
-
- java.lang.String |
-getHeader(java.lang.String name)
-
-- |
-
- java.util.Enumeration |
-getHeaderNames()
-
-- |
-
- java.util.Enumeration |
-getHeaders(java.lang.String name)
-
-- |
-
- javax.servlet.ServletInputStream |
-getInputStream()
-
-- |
-
- int |
-getIntHeader(java.lang.String name)
-
-- |
-
- java.lang.String |
-getLocalAddr()
-
-- |
-
- java.util.Locale |
-getLocale()
-
-- |
-
- java.util.Enumeration |
-getLocales()
-
-- |
-
- java.lang.String |
-getLocalName()
-
-- |
-
- int |
-getLocalPort()
-
-- |
-
- java.lang.String |
-getMethod()
-
-- |
-
- java.lang.String |
-getParameter(java.lang.String name)
-
-- |
-
- java.util.Map |
-getParameterMap()
-
-- |
-
- java.util.Enumeration |
-getParameterNames()
-
-- |
-
- java.lang.String[] |
-getParameterValues(java.lang.String name)
-
-- |
-
- java.lang.String |
-getPathInfo()
-
-- |
-
- java.lang.String |
-getPathTranslated()
-
-- |
-
- java.lang.String |
-getProtocol()
-
-- |
-
- java.lang.String |
-getQueryString()
-
-- |
-
- java.io.BufferedReader |
-getReader()
-
-- |
-
- java.lang.String |
-getRealPath(java.lang.String path)
-
-- |
-
- java.lang.String |
-getRemoteAddr()
-
-- |
-
- java.lang.String |
-getRemoteHost()
-
-- |
-
- int |
-getRemotePort()
-
-- |
-
- java.lang.String |
-getRemoteUser()
-
-- |
-
- javax.servlet.RequestDispatcher |
-getRequestDispatcher(java.lang.String path)
-
-- |
-
- java.lang.String |
-getRequestedSessionId()
-
-- |
-
- java.lang.String |
-getRequestURI()
-
-- |
-
- java.lang.StringBuffer |
-getRequestURL()
-
-- |
-
- java.lang.String |
-getScheme()
-
-- |
-
- java.lang.String |
-getServerName()
-
-- |
-
- int |
-getServerPort()
-
-- |
-
- java.lang.String |
-getServletPath()
-
-- |
-
- javax.servlet.http.HttpSession |
-getSession()
-
-- |
-
- javax.servlet.http.HttpSession |
-getSession(boolean create)
-
-- |
-
- java.security.Principal |
-getUserPrincipal()
-
-- |
-
- boolean |
-isRequestedSessionIdFromCookie()
-
-- |
-
- boolean |
-isRequestedSessionIdFromUrl()
-
-- |
-
- boolean |
-isRequestedSessionIdFromURL()
-
-- |
-
- boolean |
-isRequestedSessionIdValid()
-
-- |
-
- boolean |
-isSecure()
-
-- |
-
- boolean |
-isUserInRole(java.lang.String role)
-
-- |
-
- void |
-removeAttribute(java.lang.String name)
-
-- |
-
- void |
-removeParameter(java.lang.String name)
-
-- |
-
- void |
-setAttribute(java.lang.String name,
- java.lang.Object o)
-
-- |
-
- void |
-setCharacterEncoding(java.lang.String env)
-
-- |
-
- void |
-setContentType(java.lang.String value)
-
-- |
-
- void |
-setCookie(java.lang.String name,
- java.lang.String value)
-
-- |
-
- void |
-setCookies(java.util.ArrayList list)
-
-- Sets the cookies. |
-
- void |
-setMethod(java.lang.String value)
-
-- |
-
- void |
-setRequestURI(java.lang.String uri)
-
-- |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-TestHttpServletRequest
--public TestHttpServletRequest()-
-
-
- -
-TestHttpServletRequest
--public TestHttpServletRequest(java.lang.String uri, - byte[] body)-
-
-
| -Method Detail | -
-getAuthType
--public java.lang.String getAuthType()-
-
-
-
-
- Specified by:
getAuthTypein interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getContextPath
--public java.lang.String getContextPath()-
-
-
-
-
- Specified by:
getContextPathin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-addParameter
--public void addParameter(java.lang.String name, - java.lang.String value)-
-
-
- Adds the parameter.
-
-
-
-
-
-
- Parameters:
name- the namevalue- the value
- -
-removeParameter
--public void removeParameter(java.lang.String name)-
-
-
-
-
--
-
-
- -
-addHeader
--public void addHeader(java.lang.String name, - java.lang.String value)-
-
-
- Adds the header.
-
-
-
-
-
-
- Parameters:
name- the namevalue- the value
- -
-setCookies
--public void setCookies(java.util.ArrayList list)-
-
-
- Sets the cookies.
-
-
-
-
-
-
- Parameters:
list- the new cookies
- -
-setCookie
--public void setCookie(java.lang.String name, - java.lang.String value)-
-
-
-
-
--
-
-
- -
-clearCookies
--public void clearCookies()-
-
-
-
-
--
-
-
- -
-getCookies
--public javax.servlet.http.Cookie[] getCookies()-
-
-
-
-
- Specified by:
getCookiesin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getDateHeader
--public long getDateHeader(java.lang.String name)-
-
-
-
-
- Specified by:
getDateHeaderin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getHeader
--public java.lang.String getHeader(java.lang.String name)-
-
-
-
-
- Specified by:
getHeaderin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getHeaderNames
--public java.util.Enumeration getHeaderNames()-
-
-
-
-
- Specified by:
getHeaderNamesin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getHeaders
--public java.util.Enumeration getHeaders(java.lang.String name)-
-
-
-
-
- Specified by:
getHeadersin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getIntHeader
--public int getIntHeader(java.lang.String name)-
-
-
-
-
- Specified by:
getIntHeaderin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getMethod
--public java.lang.String getMethod()-
-
-
-
-
- Specified by:
getMethodin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-setMethod
--public void setMethod(java.lang.String value)-
-
-
-
-
--
-
-
- -
-getPathInfo
--public java.lang.String getPathInfo()-
-
-
-
-
- Specified by:
getPathInfoin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getPathTranslated
--public java.lang.String getPathTranslated()-
-
-
-
-
- Specified by:
getPathTranslatedin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getQueryString
--public java.lang.String getQueryString()-
-
-
-
-
- Specified by:
getQueryStringin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getRemoteUser
--public java.lang.String getRemoteUser()-
-
-
-
-
- Specified by:
getRemoteUserin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getRequestURI
--public java.lang.String getRequestURI()-
-
-
-
-
- Specified by:
getRequestURIin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getRequestURL
--public java.lang.StringBuffer getRequestURL()-
-
-
-
-
- Specified by:
getRequestURLin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getRequestedSessionId
--public java.lang.String getRequestedSessionId()-
-
-
-
-
- Specified by:
getRequestedSessionIdin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getServletPath
--public java.lang.String getServletPath()-
-
-
-
-
- Specified by:
getServletPathin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getSession
--public javax.servlet.http.HttpSession getSession()-
-
-
-
-
- Specified by:
getSessionin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getSession
--public javax.servlet.http.HttpSession getSession(boolean create)-
-
-
-
-
- Specified by:
getSessionin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getUserPrincipal
--public java.security.Principal getUserPrincipal()-
-
-
-
-
- Specified by:
getUserPrincipalin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-isRequestedSessionIdFromCookie
--public boolean isRequestedSessionIdFromCookie()-
-
-
-
-
- Specified by:
isRequestedSessionIdFromCookiein interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-isRequestedSessionIdFromURL
--public boolean isRequestedSessionIdFromURL()-
-
-
-
-
- Specified by:
isRequestedSessionIdFromURLin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-isRequestedSessionIdFromUrl
--public boolean isRequestedSessionIdFromUrl()-
-
-
-
-
- Specified by:
isRequestedSessionIdFromUrlin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-isRequestedSessionIdValid
--public boolean isRequestedSessionIdValid()-
-
-
-
-
- Specified by:
isRequestedSessionIdValidin interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-isUserInRole
--public boolean isUserInRole(java.lang.String role)-
-
-
-
-
- Specified by:
isUserInRolein interfacejavax.servlet.http.HttpServletRequest
--
-
-
- -
-getAttribute
--public java.lang.Object getAttribute(java.lang.String name)-
-
-
-
-
- Specified by:
getAttributein interfacejavax.servlet.ServletRequest
--
-
-
- -
-getAttributeNames
--public java.util.Enumeration getAttributeNames()-
-
-
-
-
- Specified by:
getAttributeNamesin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getCharacterEncoding
--public java.lang.String getCharacterEncoding()-
-
-
-
-
- Specified by:
getCharacterEncodingin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getContentLength
--public int getContentLength()-
-
-
-
-
- Specified by:
getContentLengthin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getContentType
--public java.lang.String getContentType()-
-
-
-
-
- Specified by:
getContentTypein interfacejavax.servlet.ServletRequest
--
-
-
- -
-setContentType
--public void setContentType(java.lang.String value)-
-
-
-
-
--
-
-
- -
-getInputStream
--public javax.servlet.ServletInputStream getInputStream() - throws java.io.IOException-
-
-
-
-
- Specified by:
getInputStreamin interfacejavax.servlet.ServletRequest
--
-
-
- Throws: -
java.io.IOException
-
- -
-getLocalAddr
--public java.lang.String getLocalAddr()-
-
-
-
-
- Specified by:
getLocalAddrin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getLocalName
--public java.lang.String getLocalName()-
-
-
-
-
- Specified by:
getLocalNamein interfacejavax.servlet.ServletRequest
--
-
-
- -
-getLocalPort
--public int getLocalPort()-
-
-
-
-
- Specified by:
getLocalPortin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getLocale
--public java.util.Locale getLocale()-
-
-
-
-
- Specified by:
getLocalein interfacejavax.servlet.ServletRequest
--
-
-
- -
-getLocales
--public java.util.Enumeration getLocales()-
-
-
-
-
- Specified by:
getLocalesin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getParameter
--public java.lang.String getParameter(java.lang.String name)-
-
-
-
-
- Specified by:
getParameterin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getParameterMap
--public java.util.Map getParameterMap()-
-
-
-
-
- Specified by:
getParameterMapin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getParameterNames
--public java.util.Enumeration getParameterNames()-
-
-
-
-
- Specified by:
getParameterNamesin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getParameterValues
--public java.lang.String[] getParameterValues(java.lang.String name)-
-
-
-
-
- Specified by:
getParameterValuesin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getProtocol
--public java.lang.String getProtocol()-
-
-
-
-
- Specified by:
getProtocolin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getReader
--public java.io.BufferedReader getReader() - throws java.io.IOException-
-
-
-
-
- Specified by:
getReaderin interfacejavax.servlet.ServletRequest
--
-
-
- Throws: -
java.io.IOException
-
- -
-getRealPath
--public java.lang.String getRealPath(java.lang.String path)-
-
-
-
-
- Specified by:
getRealPathin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getRemoteAddr
--public java.lang.String getRemoteAddr()-
-
-
-
-
- Specified by:
getRemoteAddrin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getRemoteHost
--public java.lang.String getRemoteHost()-
-
-
-
-
- Specified by:
getRemoteHostin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getRemotePort
--public int getRemotePort()-
-
-
-
-
- Specified by:
getRemotePortin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getRequestDispatcher
--public javax.servlet.RequestDispatcher getRequestDispatcher(java.lang.String path)-
-
-
-
-
- Specified by:
getRequestDispatcherin interfacejavax.servlet.ServletRequest
--
-
-
- -
-getScheme
--public java.lang.String getScheme()-
-
-
-
-
- Specified by:
getSchemein interfacejavax.servlet.ServletRequest
--
-
-
- -
-getServerName
--public java.lang.String getServerName()-
-
-
-
-
- Specified by:
getServerNamein interfacejavax.servlet.ServletRequest
--
-
-
- -
-getServerPort
--public int getServerPort()-
-
-
-
-
- Specified by:
getServerPortin interfacejavax.servlet.ServletRequest
--
-
-
- -
-isSecure
--public boolean isSecure()-
-
-
-
-
- Specified by:
isSecurein interfacejavax.servlet.ServletRequest
--
-
-
- -
-removeAttribute
--public void removeAttribute(java.lang.String name)-
-
-
-
-
- Specified by:
removeAttributein interfacejavax.servlet.ServletRequest
--
-
-
- -
-setAttribute
--public void setAttribute(java.lang.String name, - java.lang.Object o)-
-
-
-
-
- Specified by:
setAttributein interfacejavax.servlet.ServletRequest
--
-
-
- -
-setCharacterEncoding
--public void setCharacterEncoding(java.lang.String env) - throws java.io.UnsupportedEncodingException-
-
-
-
-
- Specified by:
setCharacterEncodingin interfacejavax.servlet.ServletRequest
--
-
-
- Throws: -
java.io.UnsupportedEncodingException
-
- -
-setRequestURI
--public void setRequestURI(java.lang.String uri) - throws java.io.UnsupportedEncodingException-
-
-
-
-
--
-
-
- Throws: -
java.io.UnsupportedEncodingException
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/TestHttpServletResponse.html b/javadoc/org/owasp/esapi/http/TestHttpServletResponse.html deleted file mode 100644 index d13c21225..000000000 --- a/javadoc/org/owasp/esapi/http/TestHttpServletResponse.html +++ /dev/null @@ -1,1120 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.http
-
-Class TestHttpServletResponse
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.http.HttpServletResponse, javax.servlet.ServletResponse -
-
-
-
- public class TestHttpServletResponse
- extends java.lang.Object
- implements javax.servlet.http.HttpServletResponse
- extends java.lang.Object
-The Class TestHttpServletResponse. -
- -
-
-
-
- Author: -
- jwilliams -
- -
| -Field Summary | -
| Fields inherited from interface javax.servlet.http.HttpServletResponse | -
SC_ACCEPTED, SC_BAD_GATEWAY, SC_BAD_REQUEST, SC_CONFLICT, SC_CONTINUE, SC_CREATED, SC_EXPECTATION_FAILED, SC_FORBIDDEN, SC_FOUND, SC_GATEWAY_TIMEOUT, SC_GONE, SC_HTTP_VERSION_NOT_SUPPORTED, SC_INTERNAL_SERVER_ERROR, SC_LENGTH_REQUIRED, SC_METHOD_NOT_ALLOWED, SC_MOVED_PERMANENTLY, SC_MOVED_TEMPORARILY, SC_MULTIPLE_CHOICES, SC_NO_CONTENT, SC_NON_AUTHORITATIVE_INFORMATION, SC_NOT_ACCEPTABLE, SC_NOT_FOUND, SC_NOT_IMPLEMENTED, SC_NOT_MODIFIED, SC_OK, SC_PARTIAL_CONTENT, SC_PAYMENT_REQUIRED, SC_PRECONDITION_FAILED, SC_PROXY_AUTHENTICATION_REQUIRED, SC_REQUEST_ENTITY_TOO_LARGE, SC_REQUEST_TIMEOUT, SC_REQUEST_URI_TOO_LONG, SC_REQUESTED_RANGE_NOT_SATISFIABLE, SC_RESET_CONTENT, SC_SEE_OTHER, SC_SERVICE_UNAVAILABLE, SC_SWITCHING_PROTOCOLS, SC_TEMPORARY_REDIRECT, SC_UNAUTHORIZED, SC_UNSUPPORTED_MEDIA_TYPE, SC_USE_PROXY |
-
| -Constructor Summary | -|
TestHttpServletResponse()
-
-- |
-|
| -Method Summary | -|
- void |
-addCookie(javax.servlet.http.Cookie cookie)
-
-- |
-
- void |
-addDateHeader(java.lang.String name,
- long date)
-
-- |
-
- void |
-addHeader(java.lang.String name,
- java.lang.String value)
-
-- |
-
- void |
-addIntHeader(java.lang.String name,
- int value)
-
-- |
-
- boolean |
-containsHeader(java.lang.String name)
-
-- |
-
- java.lang.String |
-encodeRedirectUrl(java.lang.String url)
-
-- |
-
- java.lang.String |
-encodeRedirectURL(java.lang.String url)
-
-- |
-
- java.lang.String |
-encodeUrl(java.lang.String url)
-
-- |
-
- java.lang.String |
-encodeURL(java.lang.String url)
-
-- |
-
- void |
-flushBuffer()
-
-- |
-
- int |
-getBufferSize()
-
-- |
-
- java.lang.String |
-getCharacterEncoding()
-
-- |
-
- java.lang.String |
-getContentType()
-
-- |
-
- javax.servlet.http.Cookie |
-getCookie(java.lang.String name)
-
-- |
-
- java.util.List |
-getCookies()
-
-- Gets the cookies. |
-
- java.lang.String |
-getHeader(java.lang.String name)
-
-- Gets the header. |
-
- java.util.List |
-getHeaderNames()
-
-- Gets the header names. |
-
- java.util.Locale |
-getLocale()
-
-- |
-
- javax.servlet.ServletOutputStream |
-getOutputStream()
-
-- |
-
- int |
-getStatus()
-
-- Gets the status. |
-
- java.io.PrintWriter |
-getWriter()
-
-- |
-
- boolean |
-isCommitted()
-
-- |
-
- void |
-reset()
-
-- |
-
- void |
-resetBuffer()
-
-- |
-
- void |
-sendError(int sc)
-
-- |
-
- void |
-sendError(int sc,
- java.lang.String msg)
-
-- |
-
- void |
-sendRedirect(java.lang.String location)
-
-- |
-
- void |
-setBufferSize(int size)
-
-- |
-
- void |
-setCharacterEncoding(java.lang.String charset)
-
-- |
-
- void |
-setContentLength(int len)
-
-- |
-
- void |
-setContentType(java.lang.String type)
-
-- |
-
- void |
-setDateHeader(java.lang.String name,
- long date)
-
-- |
-
- void |
-setHeader(java.lang.String name,
- java.lang.String value)
-
-- |
-
- void |
-setIntHeader(java.lang.String name,
- int value)
-
-- |
-
- void |
-setLocale(java.util.Locale loc)
-
-- |
-
- void |
-setStatus(int sc)
-
-- |
-
- void |
-setStatus(int sc,
- java.lang.String sm)
-
-- |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-TestHttpServletResponse
--public TestHttpServletResponse()-
-
-
| -Method Detail | -
-addCookie
--public void addCookie(javax.servlet.http.Cookie cookie)-
-
-
-
-
- Specified by:
addCookiein interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-getCookies
--public java.util.List getCookies()-
-
-
- Gets the cookies.
-
-
-
-
-
-
-
- Returns:
- the cookies
- -
-getCookie
--public javax.servlet.http.Cookie getCookie(java.lang.String name)-
-
-
-
-
--
-
-
- -
-addDateHeader
--public void addDateHeader(java.lang.String name, - long date)-
-
-
-
-
- Specified by:
addDateHeaderin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-addHeader
--public void addHeader(java.lang.String name, - java.lang.String value)-
-
-
-
-
- Specified by:
addHeaderin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-addIntHeader
--public void addIntHeader(java.lang.String name, - int value)-
-
-
-
-
- Specified by:
addIntHeaderin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-containsHeader
--public boolean containsHeader(java.lang.String name)-
-
-
-
-
- Specified by:
containsHeaderin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-getHeader
--public java.lang.String getHeader(java.lang.String name)-
-
-
- Gets the header.
-
-
-
-
-
-
- Parameters:
name- the name -- Returns:
- the header
- -
-getHeaderNames
--public java.util.List getHeaderNames()-
-
-
- Gets the header names.
-
-
-
-
-
-
-
- Returns:
- the header names
- -
-encodeRedirectURL
--public java.lang.String encodeRedirectURL(java.lang.String url)-
-
-
-
-
- Specified by:
encodeRedirectURLin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-encodeRedirectUrl
--public java.lang.String encodeRedirectUrl(java.lang.String url)-
-
-
-
-
- Specified by:
encodeRedirectUrlin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-encodeURL
--public java.lang.String encodeURL(java.lang.String url)-
-
-
-
-
- Specified by:
encodeURLin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-encodeUrl
--public java.lang.String encodeUrl(java.lang.String url)-
-
-
-
-
- Specified by:
encodeUrlin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-sendError
--public void sendError(int sc) - throws java.io.IOException-
-
-
-
-
- Specified by:
sendErrorin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- Throws: -
java.io.IOException
-
- -
-sendError
--public void sendError(int sc, - java.lang.String msg) - throws java.io.IOException-
-
-
-
-
- Specified by:
sendErrorin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- Throws: -
java.io.IOException
-
- -
-sendRedirect
--public void sendRedirect(java.lang.String location) - throws java.io.IOException-
-
-
-
-
- Specified by:
sendRedirectin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- Throws: -
java.io.IOException
-
- -
-setDateHeader
--public void setDateHeader(java.lang.String name, - long date)-
-
-
-
-
- Specified by:
setDateHeaderin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-setHeader
--public void setHeader(java.lang.String name, - java.lang.String value)-
-
-
-
-
- Specified by:
setHeaderin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-setIntHeader
--public void setIntHeader(java.lang.String name, - int value)-
-
-
-
-
- Specified by:
setIntHeaderin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-setStatus
--public void setStatus(int sc)-
-
-
-
-
- Specified by:
setStatusin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-getStatus
--public int getStatus()-
-
-
- Gets the status.
-
-
-
-
-
-
-
- Returns:
- the status
- -
-setStatus
--public void setStatus(int sc, - java.lang.String sm)-
-
-
-
-
- Specified by:
setStatusin interfacejavax.servlet.http.HttpServletResponse
--
-
-
- -
-flushBuffer
--public void flushBuffer() - throws java.io.IOException-
-
-
-
-
- Specified by:
flushBufferin interfacejavax.servlet.ServletResponse
--
-
-
- Throws: -
java.io.IOException
-
- -
-getBufferSize
--public int getBufferSize()-
-
-
-
-
- Specified by:
getBufferSizein interfacejavax.servlet.ServletResponse
--
-
-
- -
-getCharacterEncoding
--public java.lang.String getCharacterEncoding()-
-
-
-
-
- Specified by:
getCharacterEncodingin interfacejavax.servlet.ServletResponse
--
-
-
- -
-getContentType
--public java.lang.String getContentType()-
-
-
-
-
- Specified by:
getContentTypein interfacejavax.servlet.ServletResponse
--
-
-
- -
-getLocale
--public java.util.Locale getLocale()-
-
-
-
-
- Specified by:
getLocalein interfacejavax.servlet.ServletResponse
--
-
-
- -
-getOutputStream
--public javax.servlet.ServletOutputStream getOutputStream() - throws java.io.IOException-
-
-
-
-
- Specified by:
getOutputStreamin interfacejavax.servlet.ServletResponse
--
-
-
- Throws: -
java.io.IOException
-
- -
-getWriter
--public java.io.PrintWriter getWriter() - throws java.io.IOException-
-
-
-
-
- Specified by:
getWriterin interfacejavax.servlet.ServletResponse
--
-
-
- Throws: -
java.io.IOException
-
- -
-isCommitted
--public boolean isCommitted()-
-
-
-
-
- Specified by:
isCommittedin interfacejavax.servlet.ServletResponse
--
-
-
- -
-reset
--public void reset()-
-
-
-
-
- Specified by:
resetin interfacejavax.servlet.ServletResponse
--
-
-
- -
-resetBuffer
--public void resetBuffer()-
-
-
-
-
- Specified by:
resetBufferin interfacejavax.servlet.ServletResponse
--
-
-
- -
-setBufferSize
--public void setBufferSize(int size)-
-
-
-
-
- Specified by:
setBufferSizein interfacejavax.servlet.ServletResponse
--
-
-
- -
-setCharacterEncoding
--public void setCharacterEncoding(java.lang.String charset)-
-
-
-
-
- Specified by:
setCharacterEncodingin interfacejavax.servlet.ServletResponse
--
-
-
- -
-setContentLength
--public void setContentLength(int len)-
-
-
-
-
- Specified by:
setContentLengthin interfacejavax.servlet.ServletResponse
--
-
-
- -
-setContentType
--public void setContentType(java.lang.String type)-
-
-
-
-
- Specified by:
setContentTypein interfacejavax.servlet.ServletResponse
--
-
-
- -
-setLocale
--public void setLocale(java.util.Locale loc)-
-
-
-
-
- Specified by:
setLocalein interfacejavax.servlet.ServletResponse
--
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/TestHttpSession.html b/javadoc/org/owasp/esapi/http/TestHttpSession.html deleted file mode 100644 index 4bef523a6..000000000 --- a/javadoc/org/owasp/esapi/http/TestHttpSession.html +++ /dev/null @@ -1,711 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.http
-
-Class TestHttpSession
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.http.HttpSession -
-
-
-
- public class TestHttpSession
- extends java.lang.Object
- implements javax.servlet.http.HttpSession
- extends java.lang.Object
-The Class TestHttpSession. -
- -
-
-
-
- Author: -
- jwilliams -
- -
| -Constructor Summary | -|
TestHttpSession()
-
-- Instantiates a new test http session. |
-|
TestHttpSession(long creationTime,
- long accessedTime)
-
-- Instantiates a new test http session. |
-|
| -Method Summary | -|
- java.lang.Object |
-getAttribute(java.lang.String string)
-
-- |
-
- java.util.Enumeration |
-getAttributeNames()
-
-- |
-
- long |
-getCreationTime()
-
-- |
-
- java.lang.String |
-getId()
-
-- |
-
- boolean |
-getInvalidated()
-
-- Gets the invalidated. |
-
- long |
-getLastAccessedTime()
-
-- |
-
- int |
-getMaxInactiveInterval()
-
-- |
-
- javax.servlet.ServletContext |
-getServletContext()
-
-- |
-
- javax.servlet.http.HttpSessionContext |
-getSessionContext()
-
-- |
-
- java.lang.Object |
-getValue(java.lang.String string)
-
-- |
-
- java.lang.String[] |
-getValueNames()
-
-- |
-
- void |
-invalidate()
-
-- |
-
- boolean |
-isNew()
-
-- |
-
- void |
-putValue(java.lang.String string,
- java.lang.Object object)
-
-- |
-
- void |
-removeAttribute(java.lang.String string)
-
-- |
-
- void |
-removeValue(java.lang.String string)
-
-- |
-
- void |
-setAccessedTime(long time)
-
-- |
-
- void |
-setAttribute(java.lang.String string,
- java.lang.Object object)
-
-- |
-
- void |
-setCreationTime(long time)
-
-- |
-
- void |
-setMaxInactiveInterval(int i)
-
-- |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-TestHttpSession
--public TestHttpSession()-
-
-
- Instantiates a new test http session.
-
-
- -
-TestHttpSession
--public TestHttpSession(long creationTime, - long accessedTime)-
-
-
- Instantiates a new test http session.
-
-
- Parameters:
creationTime- the creation timeaccessedTime- the accessed time
| -Method Detail | -
-getAttribute
--public java.lang.Object getAttribute(java.lang.String string)-
-
-
-
-
- Specified by:
getAttributein interfacejavax.servlet.http.HttpSession
--
-
-
- -
-getAttributeNames
--public java.util.Enumeration getAttributeNames()-
-
-
-
-
- Specified by:
getAttributeNamesin interfacejavax.servlet.http.HttpSession
--
-
-
- -
-getCreationTime
--public long getCreationTime()-
-
-
-
-
- Specified by:
getCreationTimein interfacejavax.servlet.http.HttpSession
--
-
-
- -
-getId
--public java.lang.String getId()-
-
-
-
-
- Specified by:
getIdin interfacejavax.servlet.http.HttpSession
--
-
-
- -
-getInvalidated
--public boolean getInvalidated()-
-
-
- Gets the invalidated.
-
-
-
-
-
-
-
- Returns:
- the invalidated
- -
-getLastAccessedTime
--public long getLastAccessedTime()-
-
-
-
-
- Specified by:
getLastAccessedTimein interfacejavax.servlet.http.HttpSession
--
-
-
- -
-getMaxInactiveInterval
--public int getMaxInactiveInterval()-
-
-
-
-
- Specified by:
getMaxInactiveIntervalin interfacejavax.servlet.http.HttpSession
--
-
-
- -
-getServletContext
--public javax.servlet.ServletContext getServletContext()-
-
-
-
-
- Specified by:
getServletContextin interfacejavax.servlet.http.HttpSession
--
-
-
- -
-getSessionContext
--public javax.servlet.http.HttpSessionContext getSessionContext()-
-
-
-
-
- Specified by:
getSessionContextin interfacejavax.servlet.http.HttpSession
--
-
-
- -
-getValue
--public java.lang.Object getValue(java.lang.String string)-
-
-
-
-
- Specified by:
getValuein interfacejavax.servlet.http.HttpSession
--
-
-
- -
-getValueNames
--public java.lang.String[] getValueNames()-
-
-
-
-
- Specified by:
getValueNamesin interfacejavax.servlet.http.HttpSession
--
-
-
- -
-invalidate
--public void invalidate()-
-
-
-
-
- Specified by:
invalidatein interfacejavax.servlet.http.HttpSession
--
-
-
- -
-isNew
--public boolean isNew()-
-
-
-
-
- Specified by:
isNewin interfacejavax.servlet.http.HttpSession
--
-
-
- -
-putValue
--public void putValue(java.lang.String string, - java.lang.Object object)-
-
-
-
-
- Specified by:
putValuein interfacejavax.servlet.http.HttpSession
--
-
-
- -
-removeAttribute
--public void removeAttribute(java.lang.String string)-
-
-
-
-
- Specified by:
removeAttributein interfacejavax.servlet.http.HttpSession
--
-
-
- -
-removeValue
--public void removeValue(java.lang.String string)-
-
-
-
-
- Specified by:
removeValuein interfacejavax.servlet.http.HttpSession
--
-
-
- -
-setAttribute
--public void setAttribute(java.lang.String string, - java.lang.Object object)-
-
-
-
-
- Specified by:
setAttributein interfacejavax.servlet.http.HttpSession
--
-
-
- -
-setMaxInactiveInterval
--public void setMaxInactiveInterval(int i)-
-
-
-
-
- Specified by:
setMaxInactiveIntervalin interfacejavax.servlet.http.HttpSession
--
-
-
- -
-setAccessedTime
--public void setAccessedTime(long time)-
-
-
-
-
--
-
-
- -
-setCreationTime
--public void setCreationTime(long time)-
-
-
-
-
--
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/TestRequestDispatcher.html b/javadoc/org/owasp/esapi/http/TestRequestDispatcher.html deleted file mode 100644 index 8c301e609..000000000 --- a/javadoc/org/owasp/esapi/http/TestRequestDispatcher.html +++ /dev/null @@ -1,294 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.http
-
-Class TestRequestDispatcher
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.RequestDispatcher -
-
-
-
- public class TestRequestDispatcher
- extends java.lang.Object
- implements javax.servlet.RequestDispatcher
- extends java.lang.Object
-
- -
| -Constructor Summary | -|
TestRequestDispatcher()
-
-- |
-|
| -Method Summary | -|
- void |
-forward(javax.servlet.ServletRequest request,
- javax.servlet.ServletResponse response)
-
-- |
-
- void |
-include(javax.servlet.ServletRequest request,
- javax.servlet.ServletResponse response)
-
-- |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-TestRequestDispatcher
--public TestRequestDispatcher()-
-
-
| -Method Detail | -
-forward
--public void forward(javax.servlet.ServletRequest request, - javax.servlet.ServletResponse response) - throws javax.servlet.ServletException, - java.io.IOException-
-
-
-
-
- Specified by:
forwardin interfacejavax.servlet.RequestDispatcher
--
-
-
- Throws: -
javax.servlet.ServletException-java.io.IOException
-
- -
-include
--public void include(javax.servlet.ServletRequest request, - javax.servlet.ServletResponse response) - throws javax.servlet.ServletException, - java.io.IOException-
-
-
-
-
- Specified by:
includein interfacejavax.servlet.RequestDispatcher
--
-
-
- Throws: -
javax.servlet.ServletException-java.io.IOException
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/TestServletInputStream.html b/javadoc/org/owasp/esapi/http/TestServletInputStream.html deleted file mode 100644 index 63fa645fb..000000000 --- a/javadoc/org/owasp/esapi/http/TestServletInputStream.html +++ /dev/null @@ -1,279 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.http
-
-Class TestServletInputStream
--java.lang.Object --
-
-
-
- public class TestServletInputStream
- extends javax.servlet.ServletInputStream
-
- -
| -Constructor Summary | -|
TestServletInputStream(byte[] body)
-
-- constructor |
-|
| -Method Summary | -|
- int |
-read()
-
-- read |
-
| Methods inherited from class javax.servlet.ServletInputStream | -
readLine |
-
| Methods inherited from class java.io.InputStream | -
available, close, mark, markSupported, read, read, reset, skip |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-TestServletInputStream
--public TestServletInputStream(byte[] body)-
-
-
- constructor
-
-
- Parameters:
body-
| -Method Detail | -
-read
--public int read() - throws java.io.IOException-
-
-
- read
-
-
-
-
-
- Throws: -
java.io.IOException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/class-use/TestFilterChain.html b/javadoc/org/owasp/esapi/http/class-use/TestFilterChain.html deleted file mode 100644 index 14ae2ccaa..000000000 --- a/javadoc/org/owasp/esapi/http/class-use/TestFilterChain.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.http.TestFilterChain
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/class-use/TestHttpServletRequest.html b/javadoc/org/owasp/esapi/http/class-use/TestHttpServletRequest.html deleted file mode 100644 index 17231d733..000000000 --- a/javadoc/org/owasp/esapi/http/class-use/TestHttpServletRequest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.http.TestHttpServletRequest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/class-use/TestHttpServletResponse.html b/javadoc/org/owasp/esapi/http/class-use/TestHttpServletResponse.html deleted file mode 100644 index a11f232dc..000000000 --- a/javadoc/org/owasp/esapi/http/class-use/TestHttpServletResponse.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.http.TestHttpServletResponse
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/class-use/TestHttpSession.html b/javadoc/org/owasp/esapi/http/class-use/TestHttpSession.html deleted file mode 100644 index 703d7a390..000000000 --- a/javadoc/org/owasp/esapi/http/class-use/TestHttpSession.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.http.TestHttpSession
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/class-use/TestRequestDispatcher.html b/javadoc/org/owasp/esapi/http/class-use/TestRequestDispatcher.html deleted file mode 100644 index aaba2f8a4..000000000 --- a/javadoc/org/owasp/esapi/http/class-use/TestRequestDispatcher.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.http.TestRequestDispatcher
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/class-use/TestServletInputStream.html b/javadoc/org/owasp/esapi/http/class-use/TestServletInputStream.html deleted file mode 100644 index 5eb4ec48c..000000000 --- a/javadoc/org/owasp/esapi/http/class-use/TestServletInputStream.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.http.TestServletInputStream
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/package-frame.html b/javadoc/org/owasp/esapi/http/package-frame.html deleted file mode 100644 index 65f3915e9..000000000 --- a/javadoc/org/owasp/esapi/http/package-frame.html +++ /dev/null @@ -1,42 +0,0 @@ - - - - - -
|
-Classes
-
- -TestFilterChain - -TestHttpServletRequest - -TestHttpServletResponse - -TestHttpSession - -TestRequestDispatcher - -TestServletInputStream |
-
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Package org.owasp.esapi.http -
-A few simple mock classes to help test the ESAPI reference -implementation. -
-See:
-
- Description
-
- -
| -Class Summary | -|
| TestFilterChain | -- |
| TestHttpServletRequest | -The Class TestHttpServletRequest. | -
| TestHttpServletResponse | -The Class TestHttpServletResponse. | -
| TestHttpSession | -The Class TestHttpSession. | -
| TestRequestDispatcher | -- |
| TestServletInputStream | -- |
-Package org.owasp.esapi.http Description -
- --A few simple mock classes to help test the ESAPI reference -implementation. These classes are not fully functional and only -implement the functions required to test the library. These -implementations are not fully accurate and may not behave like the real -Java EE classes. -
- -
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/package-tree.html b/javadoc/org/owasp/esapi/http/package-tree.html deleted file mode 100644 index 0c4106cef..000000000 --- a/javadoc/org/owasp/esapi/http/package-tree.html +++ /dev/null @@ -1,154 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Hierarchy For Package org.owasp.esapi.http -
--
-
- Package Hierarchies:
- All Packages
-
-Class Hierarchy -
--
-
- class java.lang.Object
-
-
- class java.io.InputStream
-
-
- class javax.servlet.ServletInputStream
-
-
- class org.owasp.esapi.http.TestServletInputStream
- class javax.servlet.ServletInputStream
- class org.owasp.esapi.http.TestFilterChain (implements javax.servlet.FilterChain) -
- class org.owasp.esapi.http.TestHttpServletRequest (implements javax.servlet.http.HttpServletRequest) -
- class org.owasp.esapi.http.TestHttpServletResponse (implements javax.servlet.http.HttpServletResponse) -
- class org.owasp.esapi.http.TestHttpSession (implements javax.servlet.http.HttpSession) -
- class org.owasp.esapi.http.TestRequestDispatcher (implements javax.servlet.RequestDispatcher) -
- class java.io.InputStream
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/http/package-use.html b/javadoc/org/owasp/esapi/http/package-use.html deleted file mode 100644 index 818cc238c..000000000 --- a/javadoc/org/owasp/esapi/http/package-use.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Package
org.owasp.esapi.http
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/IAccessController.html b/javadoc/org/owasp/esapi/interfaces/IAccessController.html deleted file mode 100644 index 4bd11fdf9..000000000 --- a/javadoc/org/owasp/esapi/interfaces/IAccessController.html +++ /dev/null @@ -1,469 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface IAccessController
--
-
- All Known Implementing Classes:
- AccessController -
-
-
-
- public interface IAccessController
-The IAccessController interface defines a set of methods that can be used in a wide variety of applications to - enforce access control. In most applications, access control must be performed in multiple different locations across - the various applicaton layers. This class provides access control for URLs, business functions, data, services, and - files. -
-
-
- The implementation of this interface will need to access some sort of user information repository to determine what - roles or permissions are assigned to the accountName passed into the various methods. In addition, the implementation - will also need information about the resources that are being accessed. Using the user information and the resource - information, the implementation should return an access control decision. -
- Implementers are encouraged to build on existing access control mechanisms, such as methods like isUserInRole() or - hasPrivilege(). While powerful, these methods can be confusing, as users may be in multiple roles or possess multiple - overlapping privileges. These methods encourage the use of complex boolean tests throughout the code. The point of - this interface is to centralize access control logic so that it is easy to use and easy to verify. - -
- if ( ESAPI.accessController().isAuthorizedForFunction( BUSINESS_FUNCTION ) ) {
- ... access is allowed
- } else {
- ... attack in progress
- }
-
-
- Note that in the user interface layer, access control checks can be used to control whether particular controls are
- rendered or not. These checks are supposed to fail when an unauthorized user is logged in, and do not represent
- attacks. Remember that regardless of how the user interface appears, an attacker can attempt to invoke any business
- function or access any data in your application. Therefore, access control checks in the user interface should be
- repeated in both the business logic and data layers.
-
-
- <% if ( ESAPI.accessController().isAuthorizedForFunction( ADMIN_FUNCTION ) ) { %>
- <a href="/doAdminFunction">ADMIN</a>
- <% } else { %>
- <a href="/doNormalFunction">NORMAL</a>
- <% } %>
-
-- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Method Summary | -|
- void |
-assertAuthorizedForData(java.lang.String key)
-
-- |
-
- void |
-assertAuthorizedForFile(java.lang.String filepath)
-
-- |
-
- void |
-assertAuthorizedForFunction(java.lang.String functionName)
-
-- |
-
- void |
-assertAuthorizedForService(java.lang.String serviceName)
-
-- |
-
- void |
-assertAuthorizedForURL(java.lang.String url)
-
-- |
-
- boolean |
-isAuthorizedForData(java.lang.String key)
-
-- Checks if an account is authorized to access the referenced data. |
-
- boolean |
-isAuthorizedForFile(java.lang.String filepath)
-
-- Checks if an account is authorized to access the referenced file. |
-
- boolean |
-isAuthorizedForFunction(java.lang.String functionName)
-
-- Checks if an account is authorized to access the referenced function. |
-
- boolean |
-isAuthorizedForService(java.lang.String serviceName)
-
-- Checks if an account is authorized to access the referenced service. |
-
- boolean |
-isAuthorizedForURL(java.lang.String url)
-
-- Checks if an account is authorized to access the referenced URL. |
-
| -Method Detail | -
-isAuthorizedForURL
--public boolean isAuthorizedForURL(java.lang.String url)-
-
-
- Checks if an account is authorized to access the referenced URL. The implementation should allow
- access to be granted to any part of the URI. Generally, this method should be invoked in the
- application's controller or a filter as follows:
-
ESAPI.accessController().isAuthorizedForURL(request.getRequestURI().toString());
--
-
-
-
- Returns:
- true, if is authorized for URL
- -
-isAuthorizedForFunction
--public boolean isAuthorizedForFunction(java.lang.String functionName)-
-
-
- Checks if an account is authorized to access the referenced function. The implementation should define the
- function "namespace" to be enforced. Choosing something simple like the classname of action classes or menu item
- names will make this implementation easier to use.
-
-
-
-
- Parameters:
functionName- the function name -- Returns:
- true, if is authorized for function
- -
-isAuthorizedForData
--public boolean isAuthorizedForData(java.lang.String key)-
-
-
- Checks if an account is authorized to access the referenced data. The implementation should define the data
- "namespace" to be enforced.
-
-
-
-
- Parameters:
key- the key -- Returns:
- true, if is authorized for data
- -
-isAuthorizedForFile
--public boolean isAuthorizedForFile(java.lang.String filepath)-
-
-
- Checks if an account is authorized to access the referenced file. The implementation should be extremely careful
- about canonicalization.
-
-
-
-
- Parameters:
filepath- the filepath -- Returns:
- true, if is authorized for file
- -
-isAuthorizedForService
--public boolean isAuthorizedForService(java.lang.String serviceName)-
-
-
- Checks if an account is authorized to access the referenced service. This can be used in applications that
- provide access to a variety of backend services.
-
-
-
-
- Parameters:
serviceName- the service name -- Returns:
- true, if is authorized for service
- -
-assertAuthorizedForURL
--public void assertAuthorizedForURL(java.lang.String url) - throws AccessControlException-
-
-
-
-
-
- Throws: -
AccessControlException
-
- -
-assertAuthorizedForFunction
--public void assertAuthorizedForFunction(java.lang.String functionName) - throws AccessControlException-
-
-
-
-
-
- Throws: -
AccessControlException
-
- -
-assertAuthorizedForData
--public void assertAuthorizedForData(java.lang.String key) - throws AccessControlException-
-
-
-
-
-
- Throws: -
AccessControlException
-
- -
-assertAuthorizedForFile
--public void assertAuthorizedForFile(java.lang.String filepath) - throws AccessControlException-
-
-
-
-
-
- Throws: -
AccessControlException
-
- -
-assertAuthorizedForService
--public void assertAuthorizedForService(java.lang.String serviceName) - throws AccessControlException-
-
-
-
-
-
- Throws: -
AccessControlException
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/IAccessReferenceMap.html b/javadoc/org/owasp/esapi/interfaces/IAccessReferenceMap.html deleted file mode 100644 index 8a9acfcc5..000000000 --- a/javadoc/org/owasp/esapi/interfaces/IAccessReferenceMap.html +++ /dev/null @@ -1,359 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface IAccessReferenceMap
--
-
- All Known Implementing Classes:
- AccessReferenceMap -
-
-
-
- public interface IAccessReferenceMap
-The IAccessReferenceMap interface is used to map from a set of internal - direct object references to a set of indirect references that are safe to - disclose publically. This can be used to help protect database keys, - filenames, and other types of direct object references. As a rule, developers - should not expose their direct object references as it enables attackers to - attempt to manipulate them. -
-
-
-
- Indirect references are handled as strings, to facilitate their use in HTML. - Implementations can generate simple integers or more complicated random - character strings as indirect references. Implementations should probably add - a constructor that takes a list of direct references. -
- Note that in addition to defeating all forms of parameter tampering attacks, - there is a side benefit of the AccessReferenceMap. Using random strings as indirect object - references, as opposed to simple integers makes it impossible for an attacker to - guess valid identifiers. So if per-user AccessReferenceMaps are used, then request - forgery (CSRF) attacks will also be prevented. - -
- Set fileSet = new HashSet(); - fileSet.addAll(...); - AccessReferenceMap map = new AccessReferenceMap( fileSet ); - // store the map somewhere safe - like the session! - String indRef = map.getIndirectReference( file1 ); - String href = "http://www.aspectsecurity.com/esapi?file=" + indRef ); - ... - String indref = request.getParameter( "file" ); - File file = (File)map.getDirectReference( indref ); -- -
-
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Method Summary | -|
- java.lang.String |
-addDirectReference(java.lang.Object direct)
-
-- Adds a direct reference to the AccessReferenceMap and generates an associated indirect reference. |
-
- java.lang.Object |
-getDirectReference(java.lang.String indirectReference)
-
-- Get the original direct object reference from an indirect reference. |
-
- java.lang.String |
-getIndirectReference(java.lang.Object directReference)
-
-- Get a safe indirect reference to use in place of a potentially sensitive - direct object reference. |
-
- java.util.Iterator |
-iterator()
-
-- Get an iterator through the direct object references. |
-
- java.lang.String |
-removeDirectReference(java.lang.Object direct)
-
-- Removes a direct reference and its associated indirect reference from the AccessReferenceMap. |
-
| -Method Detail | -
-iterator
--public java.util.Iterator iterator()-
-
-
- Get an iterator through the direct object references.
-
-
-
-
-
- Returns:
- the iterator
- -
-getIndirectReference
--public java.lang.String getIndirectReference(java.lang.Object directReference)-
-
-
- Get a safe indirect reference to use in place of a potentially sensitive
- direct object reference. Developers should use this call when building
- URL's, form fields, hidden fields, etc... to help protect their private
- implementation information.
-
-
-
-
- Parameters:
directReference- the direct reference -- Returns:
- the indirect reference
- -
-getDirectReference
--public java.lang.Object getDirectReference(java.lang.String indirectReference) - throws AccessControlException-
-
-
- Get the original direct object reference from an indirect reference.
- Developers should use this when they get an indirect reference from an
- HTTP request to translate it back into the real direct reference. If an
- invalid indirectReference is requested, then an AccessControlException is
- thrown.
-
-
-
-
- Parameters:
indirectReference- the indirect reference -- Returns:
- the direct reference -
- Throws: -
AccessControlException- the access control exception
- -
-addDirectReference
--public java.lang.String addDirectReference(java.lang.Object direct)-
-
-
- Adds a direct reference to the AccessReferenceMap and generates an associated indirect reference.
-
-
-
-
- Parameters:
direct-
- -
-removeDirectReference
--public java.lang.String removeDirectReference(java.lang.Object direct) - throws AccessControlException-
-
-
- Removes a direct reference and its associated indirect reference from the AccessReferenceMap.
-
-
-
-
- Parameters:
direct- -- Throws: -
AccessControlException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/IAuthenticator.html b/javadoc/org/owasp/esapi/interfaces/IAuthenticator.html deleted file mode 100644 index f2a577f32..000000000 --- a/javadoc/org/owasp/esapi/interfaces/IAuthenticator.html +++ /dev/null @@ -1,600 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface IAuthenticator
--
-
- All Known Implementing Classes:
- Authenticator -
-
-
-
- public interface IAuthenticator
-The IAuthenticator interface defines a set of methods for generating and - handling account credentials and session identifiers. The goal of this - interface is to encourage developers to protect credentials from disclosure - to the maximum extent possible. -
-
-
- Once possible implementation relies on the use of a thread local variable to - store the current user's identity. The application is responsible for calling - setCurrentUser() as soon as possible after each HTTP request is received. The - value of getCurrentUser() is used in several other places in this API. This - eliminates the need to pass a user object to methods throughout the library. - For example, all of the logging, access control, and exception calls need - access to the currently logged in user. -
- The goal is to minimize the responsibility of the developer for - authentication. In this example, the user simply calls authenticate with the - current request and the name of the parameters containing the username and - password. The implementation should verify the password if necessary, create - a session if necessary, and set the user as the current user. - -
- public void doPost(ServletRequest request, ServletResponse response) {
- try {
- ESAPI.authenticator().authenticate(request, response, "username","password");
- // continue with authenticated user
- } catch (AuthenticationException e) {
- // handle failed authentication (it's already been logged)
- }
-
-- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- void |
-clearCurrent()
-
-- Clear the current user, request, and response. |
-
- IUser |
-createUser(java.lang.String accountName,
- java.lang.String password1,
- java.lang.String password2)
-
-- Creates the user. |
-
- boolean |
-exists(java.lang.String accountName)
-
-- Verifies the account exists. |
-
- java.lang.String |
-generateStrongPassword()
-
-- Generate a strong password. |
-
- java.lang.String |
-generateStrongPassword(java.lang.String oldPassword,
- IUser user)
-
-- Generate strong password that takes into account the user's information and old password. |
-
- IUser |
-getCurrentUser()
-
-- Returns the currently logged in User. |
-
- IUser |
-getUser(java.lang.String accountName)
-
-- Returns the User matching the provided accountName. |
-
- java.util.Set |
-getUserNames()
-
-- Gets the user names. |
-
- java.lang.String |
-hashPassword(java.lang.String password,
- java.lang.String accountName)
-
-- Returns a string representation of the hashed password, using the - accountName as the salt. |
-
- IUser |
-login(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- Authenticates the user's credentials from the HttpServletRequest if - necessary, creates a session if necessary, and sets the user as the - current user. |
-
- void |
-logout()
-
-- Logs out the current user. |
-
- void |
-removeUser(java.lang.String accountName)
-
-- Removes the account. |
-
- void |
-setCurrentUser(IUser user)
-
-- Sets the currently logged in User. |
-
- void |
-verifyAccountNameStrength(java.lang.String accountName)
-
-- Validate password strength. |
-
- void |
-verifyPasswordStrength(java.lang.String newPassword,
- java.lang.String oldPassword)
-
-- Validate password strength. |
-
| -Method Detail | -
-clearCurrent
--public void clearCurrent()-
-
-
- Clear the current user, request, and response. This allows the thread to be reused safely.
-
-
-
-
- -
-login
--public IUser login(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response) - throws AuthenticationException-
-
-
- Authenticates the user's credentials from the HttpServletRequest if
- necessary, creates a session if necessary, and sets the user as the
- current user.
-
-
-
-
- Parameters:
request- the current HTTP requestresponse- the response -- Returns:
- the user -
- Throws: -
AuthenticationException- the authentication exception
- -
-logout
--public void logout()-
-
-
- Logs out the current user.
-
-
-
-
- -
-createUser
--public IUser createUser(java.lang.String accountName, - java.lang.String password1, - java.lang.String password2) - throws AuthenticationException-
-
-
- Creates the user.
-
-
-
-
- Parameters:
accountName- the account namepassword1- the passwordpassword2- copy of the password -- Returns:
- the new User object -
- Throws: -
AuthenticationException- the authentication exception
- -
-generateStrongPassword
--public java.lang.String generateStrongPassword()-
-
-
- Generate a strong password.
-
-
-
-
-
- Returns:
- the string
- -
-generateStrongPassword
--public java.lang.String generateStrongPassword(java.lang.String oldPassword, - IUser user)-
-
-
- Generate strong password that takes into account the user's information and old password.
-
-
-
-
- Parameters:
oldPassword- the old passworduser- the user -- Returns:
- the string
- -
-getUser
--public IUser getUser(java.lang.String accountName)-
-
-
- Returns the User matching the provided accountName.
-
-
-
-
- Parameters:
accountName- the account name -- Returns:
- the matching User object, or null if no match exists
- -
-getUserNames
--public java.util.Set getUserNames()-
-
-
- Gets the user names.
-
-
-
-
-
- Returns:
- the user names
- -
-getCurrentUser
--public IUser getCurrentUser()-
-
-
- Returns the currently logged in User.
-
-
-
-
-
- Returns:
- the matching User object, or the Anonymous user if no match - exists
- -
-setCurrentUser
--public void setCurrentUser(IUser user)-
-
-
- Sets the currently logged in User.
-
-
-
-
- Parameters:
user- the current user
- -
-hashPassword
--public java.lang.String hashPassword(java.lang.String password, - java.lang.String accountName) - throws EncryptionException-
-
-
- Returns a string representation of the hashed password, using the
- accountName as the salt. The salt helps to prevent against "rainbow"
- table attacks where the attacker pre-calculates hashes for known strings.
-
-
-
-
- Parameters:
password- the passwordaccountName- the account name -- Returns:
- the string -
- Throws: -
EncryptionException
- -
-removeUser
--public void removeUser(java.lang.String accountName) - throws AuthenticationException-
-
-
- Removes the account.
-
-
-
-
- Parameters:
accountName- the account name -- Throws: -
AuthenticationException- the authentication exception
- -
-verifyAccountNameStrength
--public void verifyAccountNameStrength(java.lang.String accountName) - throws AuthenticationException-
-
-
- Validate password strength.
-
-
-
-
- Parameters:
accountName- the account name -- Returns:
- true, if successful -
- Throws: -
AuthenticationException- the authentication exception
- -
-verifyPasswordStrength
--public void verifyPasswordStrength(java.lang.String newPassword, - java.lang.String oldPassword) - throws AuthenticationException-
-
-
- Validate password strength.
-
-
-
-
- Parameters:
newPassword- the new passwordoldPassword- the old password -- Returns:
- true, if successful -
- Throws: -
AuthenticationException- the authentication exception
- -
-exists
--public boolean exists(java.lang.String accountName)-
-
-
- Verifies the account exists.
-
-
-
-
- Parameters:
accountName- the account name -- Returns:
- true, if successful
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/IEncoder.html b/javadoc/org/owasp/esapi/interfaces/IEncoder.html deleted file mode 100644 index d7d40c733..000000000 --- a/javadoc/org/owasp/esapi/interfaces/IEncoder.html +++ /dev/null @@ -1,675 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface IEncoder
--
-
- All Known Implementing Classes:
- Encoder -
-
-
-
- public interface IEncoder
-The IEncoder interface contains a number of methods related to encoding input - so that it will be safe for a variety of interpreters. To prevent - double-encoding, all encoding methods should first check to see that the - input does not already contain encoded characters. There are a few methods - related to decoding that are used for canonicalization purposes. See the - Validator class for more information. -
-
-
- All of the methods here must use a "whitelist" or "positive" security model, - meaning that all characters should be encoded, except for a specific list of - "immune" characters that are known to be safe. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- java.lang.String |
-canonicalize(java.lang.String input)
-
-- This method performs canonicalization on data received to ensure that it - has been reduced to its most basic form before validation. |
-
- byte[] |
-decodeFromBase64(java.lang.String input)
-
-- Decode data encoded with BASE-64 encoding. |
-
- java.lang.String |
-decodeFromURL(java.lang.String input)
-
-- Decode from URL. |
-
- java.lang.String |
-encodeForBase64(byte[] input,
- boolean wrap)
-
-- Encode for base64. |
-
- java.lang.String |
-encodeForDN(java.lang.String input)
-
-- Encode data for use in an LDAP distinguished name. |
-
- java.lang.String |
-encodeForHTML(java.lang.String input)
-
-- Encode data for use in HTML content. |
-
- java.lang.String |
-encodeForHTMLAttribute(java.lang.String input)
-
-- Encode data for use in HTML attributes. |
-
- java.lang.String |
-encodeForJavascript(java.lang.String input)
-
-- Encode for javascript. |
-
- java.lang.String |
-encodeForLDAP(java.lang.String input)
-
-- Encode data for use in LDAP queries. |
-
- java.lang.String |
-encodeForSQL(java.lang.String input)
-
-- Encode for SQL. |
-
- java.lang.String |
-encodeForURL(java.lang.String input)
-
-- Encode for use in a URL. |
-
- java.lang.String |
-encodeForVBScript(java.lang.String input)
-
-- Encode data for use in visual basic script. |
-
- java.lang.String |
-encodeForXML(java.lang.String input)
-
-- Encode data for use in an XML element. |
-
- java.lang.String |
-encodeForXMLAttribute(java.lang.String input)
-
-- Encode data for use in an XML attribute. |
-
- java.lang.String |
-encodeForXPath(java.lang.String input)
-
-- Encode data for use in an XPath query. |
-
- java.lang.String |
-normalize(java.lang.String input)
-
-- Reduce all non-ascii characters to their ASCII form so that simpler - validation rules can be applied. |
-
| -Method Detail | -
-canonicalize
--public java.lang.String canonicalize(java.lang.String input) - throws EncodingException-
-
-
- This method performs canonicalization on data received to ensure that it
- has been reduced to its most basic form before validation. For example,
- URL-encoded data received from ordinary "application/x-www-url-encoded"
- forms so that it may be validated properly.
-
- Canonicalization is simply the operation of reducing a possibly encoded - string down to its simplest form. This is important, because attackers - frequently use encoding to change their input in a way that will bypass - validation filters, but still be interpreted properly by the target of - the attack. Note that data encoded more than once is not something that a - normal user would generate and should be regarded as an attack. -
- For input that comes from an HTTP servlet request, there are generally - two types of encoding to be concerned with. The first is - "applicaton/x-www-url-encoded" which is what is typically used in most - forms and URI's where characters are encoded in a %xy format. The other - type of common character encoding is HTML entity encoding, which uses - several formats: -
-
<
, -u
, and -:
. -- Note that all of these formats may possibly render properly in a - browser without the trailing semi-colon. -
- Double-encoding is a particularly thorny problem, as applying ordinary decoders - may introduce encoded characters, even characters encoded with a different - encoding scheme. For example %26lt; is a < character which has been entity encoded - and then the first character has been url-encoded. Implementations should - throw an IntrusionException when double-encoded characters are detected. -
- Note that there is also "multipart/form" encoding, which allows files and - other binary data to be transmitted. Each part of a multipart form can - itself be encoded according to a "Content-Transfer-Encoding" header. See - the HTTPUtilties.getSafeFileUploads() method. -
- For more information on form encoding, please refer to the W3C - specifications. -
-
-
-
- Parameters:
input- unvalidated input from an HTTP request -- Returns:
- the canonicalized string -
- Throws: -
IntrusionException- if there is a canonicalization problem -EncodingException
- -
-normalize
--public java.lang.String normalize(java.lang.String input)-
-
-
- Reduce all non-ascii characters to their ASCII form so that simpler
- validation rules can be applied. For example, an accented-e character
- will be changed into a regular ASCII e character.
-
-
-
-
- Parameters:
input- -- Returns:
- -
-encodeForHTML
--public java.lang.String encodeForHTML(java.lang.String input)-
-
-
- Encode data for use in HTML content. This method first canonicalizes and
- detects any double-encoding. If this check passes, then the data is
- entity-encoded using a whitelist.
-
-
-
-
- Parameters:
input- the input -- Returns:
- the string
- -
-encodeForHTMLAttribute
--public java.lang.String encodeForHTMLAttribute(java.lang.String input)-
-
-
- Encode data for use in HTML attributes. This method first canonicalizes
- and detects any double-encoding. If this check passes, then the data is
- entity-encoded using a whitelist.
-
-
-
-
- Parameters:
input- the input -- Returns:
- the string
- -
-encodeForJavascript
--public java.lang.String encodeForJavascript(java.lang.String input)-
-
-
- Encode for javascript. This method first canonicalizes and detects any
- double-encoding. If this check passes, then the data is encoded using a
- whitelist.
-
-
-
-
- Parameters:
input- the input -- Returns:
- the string
- -
-encodeForVBScript
--public java.lang.String encodeForVBScript(java.lang.String input)-
-
-
- Encode data for use in visual basic script. This method first
- canonicalizes and detects any double-encoding. If this check passes, then
- the data is encoded using a whitelist.
-
-
-
-
- Parameters:
input- the input -- Returns:
- the string
- -
-encodeForSQL
--public java.lang.String encodeForSQL(java.lang.String input)-
-
-
- Encode for SQL. This method first canonicalizes and detects any
- double-encoding. If this check passes, then the data is encoded using a
- whitelist.
-
-
-
-
- Parameters:
input- the input -- Returns:
- the string
- -
-encodeForLDAP
--public java.lang.String encodeForLDAP(java.lang.String input)-
-
-
- Encode data for use in LDAP queries. This method first canonicalizes and
- detects any double-encoding. If this check passes, then the data is
- encoded using a whitelist.
-
-
-
-
- Parameters:
input- the input -- Returns:
- the string
- -
-encodeForDN
--public java.lang.String encodeForDN(java.lang.String input)-
-
-
- Encode data for use in an LDAP distinguished name. This method first
- canonicalizes and detects any double-encoding. If this check passes, then
- the data is encoded using a whitelist.
-
-
-
-
- Parameters:
input- the input -- Returns:
- the string
- -
-encodeForXPath
--public java.lang.String encodeForXPath(java.lang.String input)-
-
-
- Encode data for use in an XPath query. This method first canonicalizes
- and detects any double-encoding. If this check passes, then the data is
- encoded using a whitelist.
-
-
-
-
- Parameters:
input- the input -- Returns:
- the string
- -
-encodeForXML
--public java.lang.String encodeForXML(java.lang.String input)-
-
-
- Encode data for use in an XML element. This method first canonicalizes
- and detects any double-encoding. If this check passes, then the data is
- encoded using a whitelist. The implementation should follow the XML Encoding
- Standard from the W3C.
-
- The use of a real XML parser is strongly encouraged. However, in the - hopefully rare case that you need to make sure that data is safe for - inclusion in an XML document and cannot use a parse, this method provides - a safe mechanism to do so. -
-
-
-
- Parameters:
input- the input -- Returns:
- the string
- -
-encodeForXMLAttribute
--public java.lang.String encodeForXMLAttribute(java.lang.String input)-
-
-
- Encode data for use in an XML attribute. The implementation should follow
- the XML Encoding
- Standard from the W3C. This method first canonicalizes and detects
- any double-encoding. If this check passes, then the data is encoded using
- a whitelist.
-
- The use of a real XML parser is highly encouraged. However, in the - hopefully rare case that you need to make sure that data is safe for - inclusion in an XML document and cannot use a parse, this method provides - a safe mechanism to do so. -
-
-
-
- Parameters:
input- the input -- Returns:
- the string
- -
-encodeForURL
--public java.lang.String encodeForURL(java.lang.String input) - throws EncodingException-
-
-
- Encode for use in a URL. This method performs URL encoding"
- on the entire string. This method first canonicalizes and detects any
- double-encoding. If this check passes, then the data is encoded using a
- whitelist.
-
-
-
-
- Parameters:
input- the input -- Returns:
- the string -
- Throws: -
EncodingException
- -
-decodeFromURL
--public java.lang.String decodeFromURL(java.lang.String input) - throws EncodingException-
-
-
- Decode from URL. This method first canonicalizes and detects any
- double-encoding. If this check passes, then the data is decoded using URL
- decoding.
-
-
-
-
- Parameters:
input- the input -- Returns:
- the string -
- Throws: -
java.io.IOException- Signals that an I/O exception has occurred. -EncodingException
- -
-encodeForBase64
--public java.lang.String encodeForBase64(byte[] input, - boolean wrap)-
-
-
- Encode for base64.
-
- Beware double-encoding, as this will corrupt the results and could - possibly cause a downstream security mechansim to make a mistake. -
-
-
-
- Parameters:
input- the input -- Returns:
- the string
- -
-decodeFromBase64
--public byte[] decodeFromBase64(java.lang.String input) - throws java.io.IOException-
-
-
- Decode data encoded with BASE-64 encoding.
-
- Beware double-encoded data, as the results of this method could still - contain encoded characters as part of attacks. -
-
-
-
- Parameters:
input- the input -- Returns:
- the byte[] -
- Throws: -
java.io.IOException- Signals that an I/O exception has occurred.
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/IEncryptedProperties.html b/javadoc/org/owasp/esapi/interfaces/IEncryptedProperties.html deleted file mode 100644 index 2525d37a9..000000000 --- a/javadoc/org/owasp/esapi/interfaces/IEncryptedProperties.html +++ /dev/null @@ -1,263 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface IEncryptedProperties
--
-
- All Known Implementing Classes:
- EncryptedProperties -
-
-
-
- public interface IEncryptedProperties
-The IEncryptedProperties interface is a properties file where all the data is - encrypted before it is added, and decrypted when it retrieved. -
-
-
-
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- java.lang.String |
-getProperty(java.lang.String key)
-
-- Gets the property value from the encrypted store, decrypts it, and returns the plaintext value to the caller. |
-
- java.lang.String |
-setProperty(java.lang.String key,
- java.lang.String value)
-
-- Encrypts the plaintext property value and stores the ciphertext value in the encrypted store. |
-
| -Method Detail | -
-getProperty
--public java.lang.String getProperty(java.lang.String key) - throws EncryptionException-
-
-
- Gets the property value from the encrypted store, decrypts it, and returns the plaintext value to the caller.
-
-
-
-
- Parameters:
key- the key -- Returns:
- the property -
- Throws: -
EncryptionException- the encryption exception
- -
-setProperty
--public java.lang.String setProperty(java.lang.String key, - java.lang.String value) - throws EncryptionException-
-
-
- Encrypts the plaintext property value and stores the ciphertext value in the encrypted store.
-
-
-
-
- Parameters:
key- the keyvalue- the value -- Returns:
- the object -
- Throws: -
EncryptionException- the encryption exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/IEncryptor.html b/javadoc/org/owasp/esapi/interfaces/IEncryptor.html deleted file mode 100644 index 05fdbcd95..000000000 --- a/javadoc/org/owasp/esapi/interfaces/IEncryptor.html +++ /dev/null @@ -1,488 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface IEncryptor
--
-
- All Known Implementing Classes:
- Encryptor -
-
-
-
- public interface IEncryptor
-The IEncryptor interface provides a set of methods for performing common - encryption, random number, and hashing operations. Implementations should - rely on a strong cryptographic implementation, such as JCE or BouncyCastle. - Implementors should take care to ensure that they initialize their - implementation with a strong "master key", and that they protect this secret - as much as possible. -
-
-
- Possible future enhancements (depending on feedback) might include: -
-
-
- encryptFile -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- java.lang.String |
-decrypt(java.lang.String ciphertext)
-
-- Decrypts the provided ciphertext string (encrypted with the encrypt - method) and returns a plaintext string. |
-
- java.lang.String |
-encrypt(java.lang.String plaintext)
-
-- Encrypts the provided plaintext and returns a ciphertext string. |
-
- long |
-getRelativeTimeStamp(long offset)
-
-- Gets a timestamp representing an offset from the current time to be used by - other functions in the library. |
-
- long |
-getTimeStamp()
-
-- Gets a timestamp representing the current date and time to be used by - other functions in the library. |
-
- java.lang.String |
-hash(java.lang.String plaintext,
- java.lang.String salt)
-
-- Returns a string representation of the hash of the provided plaintext and - salt. |
-
- java.lang.String |
-seal(java.lang.String data,
- long timestamp)
-
-- Creates a seal that binds a set of data and an expiration timestamp. |
-
- java.lang.String |
-sign(java.lang.String data)
-
-- Create a digital signature for the provided data and return it in a - string. |
-
- java.lang.String |
-unseal(java.lang.String seal)
-
-- Unseals data (created with the seal method) and throws an exception - describing any of the various problems that could exist with a seal, such - as an invalid seal format, expired timestamp, or decryption error. |
-
- boolean |
-verifySeal(java.lang.String seal)
-
-- Verifies a seal (created with the seal method) and throws an exception - describing any of the various problems that could exist with a seal, such - as an invalid seal format, expired timestamp, or data mismatch. |
-
- boolean |
-verifySignature(java.lang.String signature,
- java.lang.String data)
-
-- Verifies a digital signature (created with the sign method) and returns - the boolean result. |
-
| -Method Detail | -
-hash
--public java.lang.String hash(java.lang.String plaintext, - java.lang.String salt) - throws EncryptionException-
-
-
- Returns a string representation of the hash of the provided plaintext and
- salt. The salt helps to protect against a rainbow table attack by mixing
- in some extra data with the plaintext. Some good choices for a salt might
- be an account name or some other string that is known to the application
- but not to an attacker. See this article for
- more information about hashing as it pertains to password schemes.
-
-
-
-
- Parameters:
plaintext- the plaintextsalt- the salt -- Returns:
- the string -
- Throws: -
EncryptionException- the encryption exception
- -
-encrypt
--public java.lang.String encrypt(java.lang.String plaintext) - throws EncryptionException-
-
-
- Encrypts the provided plaintext and returns a ciphertext string.
-
-
-
-
- Parameters:
plaintext- the plaintext -- Returns:
- the string -
- Throws: -
EncryptionException- the encryption exception
- -
-decrypt
--public java.lang.String decrypt(java.lang.String ciphertext) - throws EncryptionException-
-
-
- Decrypts the provided ciphertext string (encrypted with the encrypt
- method) and returns a plaintext string.
-
-
-
-
- Parameters:
ciphertext- the ciphertext -- Returns:
- the string -
- Throws: -
EncryptionException- the encryption exception
- -
-sign
--public java.lang.String sign(java.lang.String data) - throws EncryptionException-
-
-
- Create a digital signature for the provided data and return it in a
- string.
-
-
-
-
- Parameters:
data- the data -- Returns:
- the string -
- Throws: -
EncryptionException- the encryption exception
- -
-verifySignature
--public boolean verifySignature(java.lang.String signature, - java.lang.String data)-
-
-
- Verifies a digital signature (created with the sign method) and returns
- the boolean result.
-
-
-
-
- Parameters:
signature- the signaturedata- the data -- Returns:
- true, if successful -
- Throws: -
EncryptionException- the encryption exception
- -
-seal
--public java.lang.String seal(java.lang.String data, - long timestamp) - throws IntegrityException-
-
-
- Creates a seal that binds a set of data and an expiration timestamp.
-
-
-
-
- Parameters:
data- the datatimestamp- the timestamp of the expiration date of the data. -- Returns:
- the string -
- Throws: -
EncryptionException- the encryption exception -IntegrityException
- -
-unseal
--public java.lang.String unseal(java.lang.String seal) - throws EncryptionException-
-
-
- Unseals data (created with the seal method) and throws an exception
- describing any of the various problems that could exist with a seal, such
- as an invalid seal format, expired timestamp, or decryption error.
-
-
-
-
- Parameters:
seal- the seal -- Throws: -
EncryptionException
- -
-verifySeal
--public boolean verifySeal(java.lang.String seal)-
-
-
- Verifies a seal (created with the seal method) and throws an exception
- describing any of the various problems that could exist with a seal, such
- as an invalid seal format, expired timestamp, or data mismatch.
-
-
-
-
- Parameters:
seal- the seal
- -
-getRelativeTimeStamp
--public long getRelativeTimeStamp(long offset)-
-
-
- Gets a timestamp representing an offset from the current time to be used by
- other functions in the library.
-
-
-
-
-
- Returns:
- the timestamp
- -
-getTimeStamp
--public long getTimeStamp()-
-
-
- Gets a timestamp representing the current date and time to be used by
- other functions in the library.
-
-
-
-
-
- Returns:
- the timestamp
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/IExecutor.html b/javadoc/org/owasp/esapi/interfaces/IExecutor.html deleted file mode 100644 index 7f163c1b5..000000000 --- a/javadoc/org/owasp/esapi/interfaces/IExecutor.html +++ /dev/null @@ -1,253 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface IExecutor
--
-
- All Known Implementing Classes:
- Executor -
-
-
-
- public interface IExecutor
-The Executor interface is used to run an OS command with less security risk. - Implementations should do as much as possible to minimize the risk of - injection into either the command or parameters. In addition, implementations - should timeout after a specified time period in order to help prevent denial - of service attacks. The class should perform logging and error handling as - well. Finally, implementation should handle errors and generate an - ExecutorException with all the necessary information. -
-
-
-
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- java.lang.String |
-executeSystemCommand(java.io.File executable,
- java.util.List params,
- java.io.File workdir,
- int timeoutSeconds)
-
-- Executes a system command after checking that the executable exists and - that the parameters have not been subject to injection with untrusted - user data. |
-
| -Method Detail | -
-executeSystemCommand
--public java.lang.String executeSystemCommand(java.io.File executable, - java.util.List params, - java.io.File workdir, - int timeoutSeconds) - throws ExecutorException-
-
-
- Executes a system command after checking that the executable exists and
- that the parameters have not been subject to injection with untrusted
- user data. Implementations shall change to the specified working
- directory before invoking the command. Also, processes should be
- interrupted after the specified timeout period has elapsed.
-
-
-
-
- Parameters:
params- the paramsworkdir- the workdirtimeoutSeconds- the timeout seconds -- Returns:
- the string -
- Throws: -
ExecutorException- the service exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/IHTTPUtilities.html b/javadoc/org/owasp/esapi/interfaces/IHTTPUtilities.html deleted file mode 100644 index c3656a045..000000000 --- a/javadoc/org/owasp/esapi/interfaces/IHTTPUtilities.html +++ /dev/null @@ -1,918 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface IHTTPUtilities
--
-
- All Known Implementing Classes:
- HTTPUtilities -
-
-
-
- public interface IHTTPUtilities
-The IHTTPUtilities interface is a collection of methods that provide additional security related to HTTP requests, - responses, sessions, cookies, headers, and logging. -
-
-
-
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- java.lang.String |
-addCSRFToken(java.lang.String href)
-
-- Adds the current user's CSRF token (see User.getCSRFToken()) to the URL for purposes of preventing CSRF attacks. |
-
- javax.servlet.http.HttpSession |
-changeSessionIdentifier()
-
-- Invalidate the old session after copying all of its contents to a newly created session with a new session id. |
-
- java.lang.String |
-decryptHiddenField(java.lang.String encrypted)
-
-- Decrypts an encrypted hidden field value and returns the cleartest. |
-
- java.util.Map |
-decryptQueryString(java.lang.String encrypted)
-
-- Takes an encrypted querystring and returns a Map containing the original parameters. |
-
- java.util.Map |
-decryptStateFromCookie()
-
-- Retrieves a map of data from the encrypted cookie. |
-
- void |
-enableRememberToken(int maxAge,
- java.lang.String domain,
- java.lang.String path)
-
-- Set a cookie containing the current User's remember token for automatic authentication. |
-
- java.lang.String |
-encryptHiddenField(java.lang.String value)
-
-- Encrypts a hidden field value for use in HTML. |
-
- java.lang.String |
-encryptQueryString(java.lang.String query)
-
-- Takes a querystring (i.e. |
-
- void |
-encryptStateInCookie(java.util.Map cleartext)
-
-- Stores a Map of data in an encrypted cookie. |
-
- java.lang.String |
-getCookie(java.lang.String name)
-
-- Returns the first cookie matching the given name. |
-
- javax.servlet.http.HttpServletRequest |
-getCurrentRequest()
-
-- Retrieves the current HttpServletRequest |
-
- javax.servlet.http.HttpServletResponse |
-getCurrentResponse()
-
-- Retrieves the current HttpServletResponse |
-
- java.util.List |
-getSafeFileUploads(java.io.File tempDir,
- java.io.File finalDir)
-
-- Extract uploaded files from a multipart HTTP requests. |
-
- boolean |
-isSecureChannel()
-
-- Returns true if the request and response are using an SSL-enabled connection. |
-
- void |
-killAllCookies()
-
-- Kill all cookies received in the last request from the browser. |
-
- void |
-killCookie(java.lang.String name)
-
-- Kills the specified cookie by setting a new cookie that expires immediately. |
-
- void |
-logHTTPRequest(ILogger logger)
-
-- Format the Source IP address, URL, URL parameters, and all form - parameters into a string suitable for the log file. |
-
- void |
-logHTTPRequest(ILogger logger,
- java.util.List parameterNamesToObfuscate)
-
-- Format the Source IP address, URL, URL parameters, and all form - parameters into a string suitable for the log file. |
-
- void |
-safeAddCookie(java.lang.String name,
- java.lang.String value,
- int maxAge,
- java.lang.String domain,
- java.lang.String path)
-
-- Adds a cookie to the specified HttpServletResponse and adds the Http-Only flag. |
-
- void |
-safeAddHeader(java.lang.String name,
- java.lang.String value)
-
-- Adds a header to an HttpServletResponse after checking for special characters (such as CRLF injection) that could enable - attacks like response splitting and other header-based attacks that nobody has thought of yet. |
-
- void |
-safeSendForward(java.lang.String context,
- java.lang.String location)
-
-- This method perform a forward to any resource located inside the WEB-INF directory. |
-
- void |
-safeSendRedirect(java.lang.String context,
- java.lang.String location)
-
-- This method generates a redirect response that can only be used to redirect the browser to safe locations. |
-
- void |
-safeSetContentType()
-
-- Sets the content type on each HTTP response, to help protect against cross-site scripting attacks and other types - of injection into HTML documents. |
-
- void |
-safeSetHeader(java.lang.String name,
- java.lang.String value)
-
-- Sets a header in an HttpServletResponse after checking for special characters (such as CRLF injection) that could enable - attacks like response splitting and other header-based attacks that nobody has thought of yet. |
-
- void |
-setCurrentHTTP(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- Stores the current HttpRequest and HttpResponse so that they may be readily accessed throughout - ESAPI (and elsewhere) |
-
- void |
-setNoCacheHeaders()
-
-- Set headers to protect sensitive information against being cached in the browser. |
-
- void |
-verifyCSRFToken()
-
-- Checks the CSRF token in the URL (see User.getCSRFToken()) against the user's CSRF token and - throws an IntrusionException if it is missing. |
-
| -Method Detail | -
-addCSRFToken
--public java.lang.String addCSRFToken(java.lang.String href)-
-
-
- Adds the current user's CSRF token (see User.getCSRFToken()) to the URL for purposes of preventing CSRF attacks.
- This method should be used on all URLs to be put into all links and forms the application generates.
-
-
-
-
-
- Returns:
- the updated href with the CSRF token parameter
- -
-safeAddCookie
--public void safeAddCookie(java.lang.String name, - java.lang.String value, - int maxAge, - java.lang.String domain, - java.lang.String path)-
-
-
- Adds a cookie to the specified HttpServletResponse and adds the Http-Only flag.
-
-
-
-
- Parameters:
name- the namevalue- the valuedomain- the domainpath- the pathmaxAge- the max age
- -
-safeAddHeader
--public void safeAddHeader(java.lang.String name, - java.lang.String value) - throws ValidationException-
-
-
- Adds a header to an HttpServletResponse after checking for special characters (such as CRLF injection) that could enable
- attacks like response splitting and other header-based attacks that nobody has thought of yet.
-
-
-
-
- Parameters:
name- the namevalue- the value -- Throws: -
ValidationException
- -
-safeSetHeader
--public void safeSetHeader(java.lang.String name, - java.lang.String value) - throws ValidationException-
-
-
- Sets a header in an HttpServletResponse after checking for special characters (such as CRLF injection) that could enable
- attacks like response splitting and other header-based attacks that nobody has thought of yet.
-
-
-
-
- Parameters:
name- the namevalue- the value -- Throws: -
ValidationException
- -
-changeSessionIdentifier
--public javax.servlet.http.HttpSession changeSessionIdentifier() - throws AuthenticationException-
-
-
- Invalidate the old session after copying all of its contents to a newly created session with a new session id.
- Note that this is different from logging out and creating a new session identifier that does not contain the
- existing session contents. Care should be taken to use this only when the existing session does not contain
- hazardous contents.
-
-
-
-
-
- Returns:
- the http session -
- Throws: -
EnterpriseSecurityException- the enterprise security exception -AuthenticationException
- -
-verifyCSRFToken
--public void verifyCSRFToken() - throws IntrusionException-
-
-
- Checks the CSRF token in the URL (see User.getCSRFToken()) against the user's CSRF token and
- throws an IntrusionException if it is missing.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-decryptHiddenField
--public java.lang.String decryptHiddenField(java.lang.String encrypted)-
-
-
- Decrypts an encrypted hidden field value and returns the cleartest. If the field does not decrypt properly,
- an IntrusionException is thrown to indicate tampering.
-
-
-
-
- Parameters:
encrypted- -- Returns:
- -
-enableRememberToken
--public void enableRememberToken(int maxAge, - java.lang.String domain, - java.lang.String path)-
-
-
- Set a cookie containing the current User's remember token for automatic authentication. The use of remember tokens
- is not recommended, but this method will help do it as safely as possible. The user interface should strongly warn
- the user that this should only be enabled on computers where no other users will have access.
-
-
-
-
- Parameters:
maxAge-domain-path-
- -
-encryptHiddenField
--public java.lang.String encryptHiddenField(java.lang.String value) - throws EncryptionException-
-
-
- Encrypts a hidden field value for use in HTML.
-
-
-
-
- Parameters:
value- -- Returns:
- -
- Throws: -
EncryptionException
- -
-encryptQueryString
--public java.lang.String encryptQueryString(java.lang.String query) - throws EncryptionException-
-
-
- Takes a querystring (i.e. everything after the ? in the URL) and returns an encrypted string containing the parameters.
-
-
-
-
-
- Returns:
- -
- Throws: -
EncryptionException
- -
-decryptQueryString
--public java.util.Map decryptQueryString(java.lang.String encrypted) - throws EncryptionException-
-
-
- Takes an encrypted querystring and returns a Map containing the original parameters.
-
-
-
-
- Parameters:
encrypted- -- Returns:
- -
- Throws: -
EncryptionException
- -
-getCookie
--public java.lang.String getCookie(java.lang.String name)-
-
-
- Returns the first cookie matching the given name.
-
-
-
-
- -
-getSafeFileUploads
--public java.util.List getSafeFileUploads(java.io.File tempDir, - java.io.File finalDir) - throws ValidationException-
-
-
- Extract uploaded files from a multipart HTTP requests. Implementations must check the content to ensure that it
- is safe before making a permanent copy on the local filesystem. Checks should include length and content checks,
- possibly virus checking, and path and name checks. Refer to the file checking methods in IValidator for more
- information.
-
-
-
-
- Parameters:
tempDir- the temp dirfinalDir- the final dir -- Returns:
- List of new File objects from upload -
- Throws: -
ValidationException- the validation exception
- -
-decryptStateFromCookie
--public java.util.Map decryptStateFromCookie() - throws EncryptionException-
-
-
- Retrieves a map of data from the encrypted cookie.
-
-
-
-
-
- Throws: -
EncryptionException
- -
-isSecureChannel
--public boolean isSecureChannel()-
-
-
- Returns true if the request and response are using an SSL-enabled connection. This check should be made on
- every request from the login page through the logout confirmation page. Essentially, any page that uses the
- Authenticator.login() call should call this. Implementers should consider calling this method directly in
- their Authenticator.login() method. If this method returns true for a page that requires SSL, there must be a
- misconfiguration, an AuthenticationException is warranted.
-
-
-
-
-
- Returns:
- -
-killAllCookies
--public void killAllCookies()-
-
-
- Kill all cookies received in the last request from the browser. Note that new cookies set by the application in
- this response may not be killed by this method.
-
-
-
-
- -
-killCookie
--public void killCookie(java.lang.String name)-
-
-
- Kills the specified cookie by setting a new cookie that expires immediately.
-
-
-
-
- Parameters:
name- the cookie name
- -
-encryptStateInCookie
--public void encryptStateInCookie(java.util.Map cleartext) - throws EncryptionException-
-
-
- Stores a Map of data in an encrypted cookie.
-
-
-
-
-
- Throws: -
EncryptionException
- -
-safeSendRedirect
--public void safeSendRedirect(java.lang.String context, - java.lang.String location) - throws java.io.IOException-
-
-
- This method generates a redirect response that can only be used to redirect the browser to safe locations.
- Importantly, redirect requests can be modified by attackers, so do not rely information contained within redirect
- requests, and do not include sensitive information in a redirect.
-
-
-
-
- Parameters:
location- the URL to redirect to -- Throws: -
java.io.IOException- Signals that an I/O exception has occurred.
- -
-safeSendForward
--public void safeSendForward(java.lang.String context, - java.lang.String location) - throws AccessControlException, - javax.servlet.ServletException, - java.io.IOException-
-
-
- This method perform a forward to any resource located inside the WEB-INF directory. Forwarding to
- publically accessible resources can be dangerous, as the request will have already passed the URL
- based access control check. This method ensures that you can only forward to non-publically
- accessible resources.
-
-
-
-
- Parameters:
context-location- -- Throws: -
AccessControlException-javax.servlet.ServletException-java.io.IOException
- -
-safeSetContentType
--public void safeSetContentType()-
-
-
- Sets the content type on each HTTP response, to help protect against cross-site scripting attacks and other types
- of injection into HTML documents.
-
-
-
-
- -
-setNoCacheHeaders
--public void setNoCacheHeaders()-
-
-
- Set headers to protect sensitive information against being cached in the browser. Developers should make this
- call for any HTTP responses that contain any sensitive data that should not be cached within the browser or any
- intermediate proxies or caches. Implementations should set headers for the expected browsers. The safest approach
- is to set all relevant headers to their most restrictive setting. These include:
-
-
- - Cache-Control: no-store
- - Note that the header "pragma: no-cache" is only useful in HTTP requests, not HTTP responses. So even though there - are many articles recommending the use of this header, it is not helpful for preventing browser caching. For more - information, please refer to the relevant standards: -
- Cache-Control: no-cache
- Cache-Control: must-revalidate
- Expires: -1
- --
-
- HTTP/1.1 Cache-Control "no-cache" -
- HTTP/1.1 Cache-Control "no-store" -
- HTTP/1.0 Pragma "no-cache" -
- HTTP/1.0 Expires -
- IE6 Caching Issues -
- Firefox browser.cache.disk_cache_ssl -
- Mozilla -
-
-
-
- -
-setCurrentHTTP
--public void setCurrentHTTP(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response)-
-
-
- Stores the current HttpRequest and HttpResponse so that they may be readily accessed throughout
- ESAPI (and elsewhere)
-
-
-
-
- Parameters:
request- the current requestresponse- the current response
- -
-getCurrentRequest
--public javax.servlet.http.HttpServletRequest getCurrentRequest()-
-
-
- Retrieves the current HttpServletRequest
-
-
-
-
-
- Returns:
- the current request
- -
-getCurrentResponse
--public javax.servlet.http.HttpServletResponse getCurrentResponse()-
-
-
- Retrieves the current HttpServletResponse
-
-
-
-
-
- Returns:
- the current response
- -
-logHTTPRequest
--public void logHTTPRequest(ILogger logger)-
-
-
- Format the Source IP address, URL, URL parameters, and all form
- parameters into a string suitable for the log file. Be careful not
- to log sensitive information, and consider masking with the
- logHTTPRequest( List parameterNamesToObfuscate ) method.
-
-
-
-
- -
-logHTTPRequest
--public void logHTTPRequest(ILogger logger, - java.util.List parameterNamesToObfuscate)-
-
-
- Format the Source IP address, URL, URL parameters, and all form
- parameters into a string suitable for the log file. The list of parameters to
- obfuscate should be specified in order to prevent sensitive information
- from being logged. If a null list is provided, then all parameters will
- be logged.
-
-
-
-
- Parameters:
parameterNamesToObfuscate- the sensitive params
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/IIntrusionDetector.html b/javadoc/org/owasp/esapi/interfaces/IIntrusionDetector.html deleted file mode 100644 index c93433828..000000000 --- a/javadoc/org/owasp/esapi/interfaces/IIntrusionDetector.html +++ /dev/null @@ -1,262 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface IIntrusionDetector
--
-
- All Known Implementing Classes:
- IntrusionDetector -
-
-
-
- public interface IIntrusionDetector
-The IIntrusionDetector interface is intended to track security relevant events and identify attack behavior. The - implementation can use as much state as necessary to detect attacks, but note that storing too much state will burden - your system. -
-
-
-
- The interface is currently designed to accept exceptions as well as custom events. Implementations can use this - stream of information to detect both normal and abnormal behavior. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- void |
-addEvent(java.lang.String eventName)
-
-- Adds the event to the IntrusionDetector. |
-
- void |
-addException(java.lang.Exception exception)
-
-- Adds the exception to the IntrusionDetector. |
-
| -Method Detail | -
-addException
--public void addException(java.lang.Exception exception) - throws IntrusionException-
-
-
- Adds the exception to the IntrusionDetector.
-
-
-
-
- Parameters:
exception- the exception -- Throws: -
IntrusionException- the intrusion exception
- -
-addEvent
--public void addEvent(java.lang.String eventName) - throws IntrusionException-
-
-
- Adds the event to the IntrusionDetector.
-
-
-
-
- Parameters:
eventName- the event -- Throws: -
IntrusionException- the intrusion exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/ILogFactory.html b/javadoc/org/owasp/esapi/interfaces/ILogFactory.html deleted file mode 100644 index 1e7967c97..000000000 --- a/javadoc/org/owasp/esapi/interfaces/ILogFactory.html +++ /dev/null @@ -1,238 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface ILogFactory
--
-
- All Known Implementing Classes:
- JavaLogFactory -
-
-
-
- public interface ILogFactory
-
-
-
- Author: -
- rdawes -
- -
| -Method Summary | -|
- ILogger |
-getLogger(java.lang.Class clazz)
-
-- |
-
- ILogger |
-getLogger(java.lang.String name)
-
-- |
-
| -Method Detail | -
-getLogger
--public ILogger getLogger(java.lang.String name)-
-
-
-
-
-
- -
-getLogger
--public ILogger getLogger(java.lang.Class clazz)-
-
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/ILogger.html b/javadoc/org/owasp/esapi/interfaces/ILogger.html deleted file mode 100644 index c2d4c2da9..000000000 --- a/javadoc/org/owasp/esapi/interfaces/ILogger.html +++ /dev/null @@ -1,727 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface ILogger
--
-
- All Known Implementing Classes:
- Logger -
-
-
-
- public interface ILogger
-The ILogger interface defines a set of methods that can be used to log - security events. Implementors should use a well established logging library - as it is quite difficult to create a high-performance logger. -
-
-
- - The order of logging levels is: -
-
-
- trace -
- debug -
- info -
- warn -
- error -
- fatal (the most serious) -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Field Summary | -|
-static java.lang.String |
-PERFORMANCE
-
-- The PERFORMANCE. |
-
-static java.lang.String |
-SECURITY
-
-- The SECURITY. |
-
-static java.lang.String |
-USABILITY
-
-- The USABILITY. |
-
| -Method Summary | -|
- void |
-debug(java.lang.String type,
- java.lang.String message)
-
-- Log debug. |
-
- void |
-debug(java.lang.String type,
- java.lang.String message,
- java.lang.Throwable throwable)
-
-- Log debug. |
-
- void |
-error(java.lang.String type,
- java.lang.String message)
-
-- Log error. |
-
- void |
-error(java.lang.String type,
- java.lang.String message,
- java.lang.Throwable throwable)
-
-- Log error. |
-
- void |
-fatal(java.lang.String type,
- java.lang.String message)
-
-- Log critical. |
-
- void |
-fatal(java.lang.String type,
- java.lang.String message,
- java.lang.Throwable throwable)
-
-- Log critical. |
-
- void |
-info(java.lang.String type,
- java.lang.String message)
-
-- Log success. |
-
- void |
-info(java.lang.String type,
- java.lang.String message,
- java.lang.Throwable throwable)
-
-- Log success. |
-
- boolean |
-isDebugEnabled()
-
-- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing |
-
- boolean |
-isErrorEnabled()
-
-- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing |
-
- boolean |
-isFatalEnabled()
-
-- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing |
-
- boolean |
-isInfoEnabled()
-
-- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing |
-
- boolean |
-isTraceEnabled()
-
-- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing |
-
- boolean |
-isWarningEnabled()
-
-- Allows the caller to determine if messages logged at this level - will be discarded, to avoid performing expensive processing |
-
- void |
-trace(java.lang.String type,
- java.lang.String message)
-
-- Log trace. |
-
- void |
-trace(java.lang.String type,
- java.lang.String message,
- java.lang.Throwable throwable)
-
-- Log trace. |
-
- void |
-warning(java.lang.String type,
- java.lang.String message)
-
-- Log warning. |
-
- void |
-warning(java.lang.String type,
- java.lang.String message,
- java.lang.Throwable throwable)
-
-- Log warning. |
-
| -Field Detail | -
-SECURITY
--public static final java.lang.String SECURITY-
-
-
- The SECURITY.
-
-
-
-
- See Also:
- Constant Field Values
- -
-USABILITY
--public static final java.lang.String USABILITY-
-
-
- The USABILITY.
-
-
-
-
- See Also:
- Constant Field Values
- -
-PERFORMANCE
--public static final java.lang.String PERFORMANCE-
-
-
- The PERFORMANCE.
-
-
-
-
- See Also:
- Constant Field Values
| -Method Detail | -
-fatal
--public void fatal(java.lang.String type, - java.lang.String message)-
-
-
- Log critical.
-
-
-
-
- Parameters:
type- the typemessage- the message
- -
-fatal
--public void fatal(java.lang.String type, - java.lang.String message, - java.lang.Throwable throwable)-
-
-
- Log critical.
-
-
-
-
- Parameters:
type- the typemessage- the messagethrowable- the throwable
- -
-isFatalEnabled
--public boolean isFatalEnabled()-
-
-
- Allows the caller to determine if messages logged at this level
- will be discarded, to avoid performing expensive processing
-
-
-
-
-
- Returns:
- true if messages will be output to the log
- -
-debug
--public void debug(java.lang.String type, - java.lang.String message)-
-
-
- Log debug.
-
-
-
-
- Parameters:
type- the typemessage- the message
- -
-debug
--public void debug(java.lang.String type, - java.lang.String message, - java.lang.Throwable throwable)-
-
-
- Log debug.
-
-
-
-
- Parameters:
type- the typemessage- the messagethrowable- the throwable
- -
-isDebugEnabled
--public boolean isDebugEnabled()-
-
-
- Allows the caller to determine if messages logged at this level
- will be discarded, to avoid performing expensive processing
-
-
-
-
-
- Returns:
- true if messages will be output to the log
- -
-error
--public void error(java.lang.String type, - java.lang.String message)-
-
-
- Log error.
-
-
-
-
- Parameters:
type- the typemessage- the message
- -
-error
--public void error(java.lang.String type, - java.lang.String message, - java.lang.Throwable throwable)-
-
-
- Log error.
-
-
-
-
- Parameters:
type- the typemessage- the messagethrowable- the throwable
- -
-isErrorEnabled
--public boolean isErrorEnabled()-
-
-
- Allows the caller to determine if messages logged at this level
- will be discarded, to avoid performing expensive processing
-
-
-
-
-
- Returns:
- true if messages will be output to the log
- -
-info
--public void info(java.lang.String type, - java.lang.String message)-
-
-
- Log success.
-
-
-
-
- Parameters:
type- the typemessage- the message
- -
-info
--public void info(java.lang.String type, - java.lang.String message, - java.lang.Throwable throwable)-
-
-
- Log success.
-
-
-
-
- Parameters:
type- the typemessage- the messagethrowable- the throwable
- -
-isInfoEnabled
--public boolean isInfoEnabled()-
-
-
- Allows the caller to determine if messages logged at this level
- will be discarded, to avoid performing expensive processing
-
-
-
-
-
- Returns:
- true if messages will be output to the log
- -
-trace
--public void trace(java.lang.String type, - java.lang.String message)-
-
-
- Log trace.
-
-
-
-
- Parameters:
type- the typemessage- the message
- -
-trace
--public void trace(java.lang.String type, - java.lang.String message, - java.lang.Throwable throwable)-
-
-
- Log trace.
-
-
-
-
- Parameters:
type- the typemessage- the messagethrowable- the throwable
- -
-isTraceEnabled
--public boolean isTraceEnabled()-
-
-
- Allows the caller to determine if messages logged at this level
- will be discarded, to avoid performing expensive processing
-
-
-
-
-
- Returns:
- true if messages will be output to the log
- -
-warning
--public void warning(java.lang.String type, - java.lang.String message)-
-
-
- Log warning.
-
-
-
-
- Parameters:
type- the typemessage- the message
- -
-warning
--public void warning(java.lang.String type, - java.lang.String message, - java.lang.Throwable throwable)-
-
-
- Log warning.
-
-
-
-
- Parameters:
type- the typemessage- the messagethrowable- the throwable
- -
-isWarningEnabled
--public boolean isWarningEnabled()-
-
-
- Allows the caller to determine if messages logged at this level
- will be discarded, to avoid performing expensive processing
-
-
-
-
-
- Returns:
- true if messages will be output to the log
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/IRandomizer.html b/javadoc/org/owasp/esapi/interfaces/IRandomizer.html deleted file mode 100644 index a4c8181e9..000000000 --- a/javadoc/org/owasp/esapi/interfaces/IRandomizer.html +++ /dev/null @@ -1,354 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface IRandomizer
--
-
- All Known Implementing Classes:
- Randomizer -
-
-
-
- public interface IRandomizer
-The IRandomizer interface defines a set of methods for creating - cryptographically random numbers and strings. Implementers should be sure to - use a strong cryptographic implementation, such as the JCE or BouncyCastle. - Weak sources of randomness can undermine a wide variety of security - mechanisms. -
-
-
-
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- boolean |
-getRandomBoolean()
-
-- Returns a random boolean. |
-
- java.lang.String |
-getRandomFilename(java.lang.String extension)
-
-- Returns an unguessable random filename with the specified extension. |
-
- java.lang.String |
-getRandomGUID()
-
-- Generates a random GUID. |
-
- int |
-getRandomInteger(int min,
- int max)
-
-- Gets the random integer. |
-
- float |
-getRandomReal(float min,
- float max)
-
-- Gets the random real. |
-
- java.lang.String |
-getRandomString(int length,
- char[] characterSet)
-
-- Gets the random string. |
-
| -Method Detail | -
-getRandomString
--public java.lang.String getRandomString(int length, - char[] characterSet)-
-
-
- Gets the random string.
-
-
-
-
- Parameters:
length- the lengthcharacterSet- the character set -- Returns:
- the random string
- -
-getRandomBoolean
--public boolean getRandomBoolean()-
-
-
- Returns a random boolean.
-
-
-
-
-
- Returns:
- -
-getRandomInteger
--public int getRandomInteger(int min, - int max)-
-
-
- Gets the random integer.
-
-
-
-
- Parameters:
min- the minmax- the max -- Returns:
- the random integer
- -
-getRandomFilename
--public java.lang.String getRandomFilename(java.lang.String extension)-
-
-
- Returns an unguessable random filename with the specified extension.
-
-
-
-
- -
-getRandomReal
--public float getRandomReal(float min, - float max)-
-
-
- Gets the random real.
-
-
-
-
- Parameters:
min- the minmax- the max -- Returns:
- the random real
- -
-getRandomGUID
--public java.lang.String getRandomGUID() - throws EncryptionException-
-
-
- Generates a random GUID.
-
-
-
-
-
- Returns:
- the GUID -
- Throws: -
EncryptionException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/ISecurityConfiguration.html b/javadoc/org/owasp/esapi/interfaces/ISecurityConfiguration.html deleted file mode 100644 index 116dbc1d7..000000000 --- a/javadoc/org/owasp/esapi/interfaces/ISecurityConfiguration.html +++ /dev/null @@ -1,612 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface ISecurityConfiguration
--
-
- All Known Implementing Classes:
- SecurityConfiguration -
-
-
-
- public interface ISecurityConfiguration
-The ISecurityConfiguration interface stores all configuration information - that directs the behavior of the ESAPI implementation. -
-
-
- Protection of this configuration information is critical to the secure - operation of the application using the ESAPI. You should use operating system - access controls to limit access to wherever the configuration information is - stored. Please note that adding another layer of encryption does not make the - attackers job much more difficult. Somewhere there must be a master "secret" - that is stored unencrypted on the application platform. Creating another - layer of indirection doesn't provide any real additional security. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- java.util.List |
-getAllowedFileExtensions()
-
-- Gets the allowed file extensions. |
-
- int |
-getAllowedFileUploadSize()
-
-- Gets the allowed file upload size. |
-
- int |
-getAllowedLoginAttempts()
-
-- Gets the allowed login attempts. |
-
- java.lang.String |
-getApplicationName()
-
-- Gets the application name, used for logging |
-
- java.lang.String |
-getCharacterEncoding()
-
-- Gets the character encoding. |
-
- java.lang.String |
-getDigitalSignatureAlgorithm()
-
-- Gets the digital signature algorithm. |
-
- java.lang.String |
-getEncryptionAlgorithm()
-
-- Gets the encryption algorithm. |
-
- java.lang.String |
-getHashAlgorithm()
-
-- Gets the hasing algorithm. |
-
- java.io.File |
-getKeystore()
-
-- Gets the keystore. |
-
- char[] |
-getMasterPassword()
-
-- Gets the master password. |
-
- byte[] |
-getMasterSalt()
-
-- Gets the master salt. |
-
- int |
-getMaxOldPasswordHashes()
-
-- Gets the max old password hashes. |
-
- java.lang.String |
-getPasswordParameterName()
-
-- Gets the password parameter name. |
-
- Threshold |
-getQuota(java.lang.String eventName)
-
-- Gets an intrusion detection Quota. |
-
- java.lang.String |
-getRandomAlgorithm()
-
-- Gets the random number generation algorithm. |
-
- java.lang.String |
-getResourceDirectory()
-
-- Gets the ESAPI resource directory as a String. |
-
- java.lang.String |
-getUsernameParameterName()
-
-- Gets the username parameter name. |
-
- void |
-setResourceDirectory(java.lang.String dir)
-
-- Sets the ESAPI resource directory. |
-
| -Method Detail | -
-getApplicationName
--public java.lang.String getApplicationName()-
-
-
- Gets the application name, used for logging
-
-
-
-
-
- Returns:
- the application name
- -
-getMasterPassword
--public char[] getMasterPassword()-
-
-
- Gets the master password.
-
-
-
-
-
- Returns:
- the master password
- -
-getKeystore
--public java.io.File getKeystore()-
-
-
- Gets the keystore.
-
-
-
-
-
- Returns:
- the keystore
- -
-getMasterSalt
--public byte[] getMasterSalt()-
-
-
- Gets the master salt.
-
-
-
-
-
- Returns:
- the master salt
- -
-getAllowedFileExtensions
--public java.util.List getAllowedFileExtensions()-
-
-
- Gets the allowed file extensions.
-
-
-
-
-
- Returns:
- the allowed file extensions
- -
-getAllowedFileUploadSize
--public int getAllowedFileUploadSize()-
-
-
- Gets the allowed file upload size.
-
-
-
-
-
- Returns:
- the allowed file upload size
- -
-getPasswordParameterName
--public java.lang.String getPasswordParameterName()-
-
-
- Gets the password parameter name.
-
-
-
-
-
- Returns:
- the password parameter name
- -
-getUsernameParameterName
--public java.lang.String getUsernameParameterName()-
-
-
- Gets the username parameter name.
-
-
-
-
-
- Returns:
- the username parameter name
- -
-getEncryptionAlgorithm
--public java.lang.String getEncryptionAlgorithm()-
-
-
- Gets the encryption algorithm.
-
-
-
-
-
- Returns:
- the algorithm
- -
-getHashAlgorithm
--public java.lang.String getHashAlgorithm()-
-
-
- Gets the hasing algorithm.
-
-
-
-
-
- Returns:
- the algorithm
- -
-getCharacterEncoding
--public java.lang.String getCharacterEncoding()-
-
-
- Gets the character encoding.
-
-
-
-
-
- Returns:
- encoding name
- -
-getDigitalSignatureAlgorithm
--public java.lang.String getDigitalSignatureAlgorithm()-
-
-
- Gets the digital signature algorithm.
-
-
-
-
-
- Returns:
- encoding name
- -
-getRandomAlgorithm
--public java.lang.String getRandomAlgorithm()-
-
-
- Gets the random number generation algorithm.
-
-
-
-
-
- Returns:
- encoding name
- -
-getAllowedLoginAttempts
--public int getAllowedLoginAttempts()-
-
-
- Gets the allowed login attempts.
-
-
-
-
-
- Returns:
- the allowed login attempts
- -
-getMaxOldPasswordHashes
--public int getMaxOldPasswordHashes()-
-
-
- Gets the max old password hashes.
-
-
-
-
-
- Returns:
- the max old password hashes
- -
-getQuota
--public Threshold getQuota(java.lang.String eventName)-
-
-
- Gets an intrusion detection Quota.
-
-
-
-
- Parameters:
eventName- -- Returns:
- the matching Quota
- -
-getResourceDirectory
--public java.lang.String getResourceDirectory()-
-
-
- Gets the ESAPI resource directory as a String.
-
-
-
-
- -
-setResourceDirectory
--public void setResourceDirectory(java.lang.String dir)-
-
-
- Sets the ESAPI resource directory.
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/IUser.html b/javadoc/org/owasp/esapi/interfaces/IUser.html deleted file mode 100644 index b9facb1b1..000000000 --- a/javadoc/org/owasp/esapi/interfaces/IUser.html +++ /dev/null @@ -1,1036 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface IUser
--
-
- All Known Implementing Classes:
- User -
-
-
-
- public interface IUser
-The IUser interface represents an application user or user account. There is quite a lot of information that an - application must store for each user in order to enforce security properly. There are also many rules that govern - authentication and identity management. -
-
-
- A user account can be in one of several states. When first created, a User should be disabled, not expired, and - unlocked. To start using the account, an administrator should enable the account. The account can be locked for a - number of reasons, most commonly because they have failed login for too many times. Finally, the account can expire - after the expiration date has been reached. The User must be enabled, not expired, and unlocked in order to pass - authentication. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams at Aspect Security -
- -
| -Field Summary | -|
-static IUser |
-ANONYMOUS
-
-- |
-
| -Method Summary | -|
- void |
-addRole(java.lang.String role)
-
-- Adds a role to an account. |
-
- void |
-addRoles(java.util.Set newRoles)
-
-- Adds the roles. |
-
- void |
-changePassword(java.lang.String oldPassword,
- java.lang.String newPassword1,
- java.lang.String newPassword2)
-
-- Sets the user's password, performing a verification of the user's old password, the equality of the two new - passwords, and the strength of the new password. |
-
- void |
-disable()
-
-- Disable account. |
-
- void |
-enable()
-
-- Enable account. |
-
- java.lang.String |
-getAccountName()
-
-- Gets the account name. |
-
- java.lang.String |
-getCSRFToken()
-
-- Gets the CSRF token. |
-
- int |
-getFailedLoginCount()
-
-- Returns the number of failed login attempts since the last successful login for an account. |
-
- java.util.Date |
-getLastFailedLoginTime()
-
-- Returns the date of the last failed login time for a user. |
-
- java.lang.String |
-getLastHostAddress()
-
-- Returns the last host address used by the user. |
-
- java.util.Date |
-getLastLoginTime()
-
-- Returns the date of the last successful login time for a user. |
-
- java.util.Date |
-getLastPasswordChangeTime()
-
-- Gets the last password change time. |
-
- java.util.Set |
-getRoles()
-
-- Gets the roles assigned to a particular account. |
-
- java.lang.String |
-getScreenName()
-
-- Gets the screen name. |
-
- void |
-incrementFailedLoginCount()
-
-- Increment failed login count. |
-
- boolean |
-isAnonymous()
-
-- Checks if is anonymous. |
-
- boolean |
-isEnabled()
-
-- Checks if an account is currently enabled. |
-
- boolean |
-isExpired()
-
-- Checks if an account is expired. |
-
- boolean |
-isInRole(java.lang.String role)
-
-- Checks if an account has been assigned a particular role. |
-
- boolean |
-isLocked()
-
-- Checks if an account is unlocked. |
-
- boolean |
-isLoggedIn()
-
-- Tests to see if the user is currently logged in. |
-
- boolean |
-isSessionAbsoluteTimeout()
-
-- Tests to see if the user's session has exceeded the absolute time out. |
-
- boolean |
-isSessionTimeout()
-
-- Tests to see if the user's session has timed out from inactivity. |
-
- void |
-lock()
-
-- Lock the user's account. |
-
- void |
-loginWithPassword(java.lang.String password)
-
-- Login with password. |
-
- void |
-logout()
-
-- Logout this user. |
-
- void |
-removeRole(java.lang.String role)
-
-- Removes a role from an account. |
-
- java.lang.String |
-resetCSRFToken()
-
-- Returns a token to be used as a prevention against CSRF attacks. |
-
- java.lang.String |
-resetRememberToken()
-
-- Returns a token to be used as a "remember me" cookie. |
-
- void |
-setAccountName(java.lang.String accountName)
-
-- Sets the account name. |
-
- void |
-setRoles(java.util.Set roles)
-
-- Sets the roles. |
-
- void |
-setScreenName(java.lang.String screenName)
-
-- Sets the screen name. |
-
- void |
-unlock()
-
-- Unlock account. |
-
- boolean |
-verifyPassword(java.lang.String password)
-
-- Verify that the supplied password matches the password for this user. |
-
| -Field Detail | -
-ANONYMOUS
--public static final IUser ANONYMOUS-
-
-
-
-
| -Method Detail | -
-addRole
--public void addRole(java.lang.String role) - throws AuthenticationException-
-
-
- Adds a role to an account.
-
-
-
-
- Parameters:
role- the role -- Throws: -
AuthenticationException- the authentication exception
- -
-addRoles
--public void addRoles(java.util.Set newRoles) - throws AuthenticationException-
-
-
- Adds the roles.
-
-
-
-
- Parameters:
newRoles- the new roles -- Throws: -
AuthenticationException- the authentication exception
- -
-changePassword
--public void changePassword(java.lang.String oldPassword, - java.lang.String newPassword1, - java.lang.String newPassword2) - throws AuthenticationException, - EncryptionException-
-
-
- Sets the user's password, performing a verification of the user's old password, the equality of the two new
- passwords, and the strength of the new password.
-
-
-
-
- Parameters:
oldPassword- the old passwordnewPassword1- the new password1newPassword2- the new password2 -- Throws: -
AuthenticationException- the authentication exception -EncryptionException
- -
-disable
--public void disable()-
-
-
- Disable account.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-enable
--public void enable()-
-
-
- Enable account.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-getAccountName
--public java.lang.String getAccountName()-
-
-
- Gets the account name.
-
-
-
-
-
- Returns:
- the account name
- -
-getCSRFToken
--public java.lang.String getCSRFToken()-
-
-
- Gets the CSRF token.
-
-
-
-
-
- Returns:
- the CSRF token
- -
-getFailedLoginCount
--public int getFailedLoginCount()-
-
-
- Returns the number of failed login attempts since the last successful login for an account. This method is
- intended to be used as a part of the account lockout feature, to help protect against brute force attacks.
- However, the implementor should be aware that lockouts can be used to prevent access to an application by a
- legitimate user, and should consider the risk of denial of service.
-
-
-
-
-
- Returns:
- the number of failed login attempts since the last successful login
- -
-getLastHostAddress
--public java.lang.String getLastHostAddress()-
-
-
- Returns the last host address used by the user. This will be used in any log messages generated by the processing
- of this request.
-
-
-
-
-
- Returns:
- -
-getLastFailedLoginTime
--public java.util.Date getLastFailedLoginTime() - throws AuthenticationException-
-
-
- Returns the date of the last failed login time for a user. This date should be used in a message to users after a
- successful login, to notify them of potential attack activity on their account.
-
-
-
-
-
- Returns:
- date of the last failed login -
- Throws: -
AuthenticationException- the authentication exception
- -
-getLastLoginTime
--public java.util.Date getLastLoginTime()-
-
-
- Returns the date of the last successful login time for a user. This date should be used in a message to users
- after a successful login, to notify them of potential attack activity on their account.
-
-
-
-
-
- Returns:
- date of the last successful login
- -
-getLastPasswordChangeTime
--public java.util.Date getLastPasswordChangeTime()-
-
-
- Gets the last password change time.
-
-
-
-
-
- Returns:
- the last password change time
- -
-getRoles
--public java.util.Set getRoles()-
-
-
- Gets the roles assigned to a particular account.
-
-
-
-
-
- Returns:
- an immutable set of roles
- -
-getScreenName
--public java.lang.String getScreenName()-
-
-
- Gets the screen name.
-
-
-
-
-
- Returns:
- the screen name
- -
-incrementFailedLoginCount
--public void incrementFailedLoginCount()-
-
-
- Increment failed login count.
-
-
-
-
- -
-isAnonymous
--public boolean isAnonymous()-
-
-
- Checks if is anonymous.
-
-
-
-
-
- Returns:
- true, if is anonymous
- -
-isEnabled
--public boolean isEnabled()-
-
-
- Checks if an account is currently enabled.
-
-
-
-
-
- Returns:
- true, if is enabled account
- -
-isExpired
--public boolean isExpired()-
-
-
- Checks if an account is expired.
-
-
-
-
-
- Returns:
- true, account is expired
- -
-isInRole
--public boolean isInRole(java.lang.String role)-
-
-
- Checks if an account has been assigned a particular role.
-
-
-
-
- Parameters:
role- the role -- Returns:
- true, if is user in role
- -
-isLocked
--public boolean isLocked()-
-
-
- Checks if an account is unlocked.
-
-
-
-
-
- Returns:
- true, account is unlocked
- -
-isLoggedIn
--public boolean isLoggedIn()-
-
-
- Tests to see if the user is currently logged in.
-
-
-
-
-
- Returns:
- true if the user is logged out
- -
-isSessionAbsoluteTimeout
--public boolean isSessionAbsoluteTimeout()-
-
-
- Tests to see if the user's session has exceeded the absolute time out.
-
-
-
-
-
- Returns:
- whether user's session has exceeded the absolute time out
- -
-isSessionTimeout
--public boolean isSessionTimeout()-
-
-
- Tests to see if the user's session has timed out from inactivity.
-
-
-
-
-
- Returns:
- whether user's session has timed out from inactivity
- -
-lock
--public void lock()-
-
-
- Lock the user's account.
-
-
-
-
- -
-loginWithPassword
--public void loginWithPassword(java.lang.String password) - throws AuthenticationException-
-
-
- Login with password.
-
-
-
-
- Parameters:
password- the password -- Throws: -
AuthenticationException- the authentication exception
- -
-logout
--public void logout()-
-
-
- Logout this user.
-
-
-
-
- -
-removeRole
--public void removeRole(java.lang.String role) - throws AuthenticationException-
-
-
- Removes a role from an account.
-
-
-
-
- Parameters:
role- the role -- Throws: -
AuthenticationException- the authentication exception
- -
-resetCSRFToken
--public java.lang.String resetCSRFToken() - throws AuthenticationException-
-
-
- Returns a token to be used as a prevention against CSRF attacks. This token should be added to all links and
- forms. The application should verify that all requests contain the token, or they may have been generated by a
- CSRF attack. It is generally best to perform the check in a centralized location, either a filter or controller.
- See the verifyCSRFToken method.
-
-
-
-
-
- Returns:
- the string -
- Throws: -
AuthenticationException- the authentication exception
- -
-resetRememberToken
--public java.lang.String resetRememberToken() - throws AuthenticationException-
-
-
- Returns a token to be used as a "remember me" cookie. The cookie is not seen by the user and can be fairly long,
- at least 20 digits is suggested to prevent brute force attacks. See loginWithRememberToken.
-
-
-
-
-
- Returns:
- the string -
- Throws: -
AuthenticationException- the authentication exception
- -
-setAccountName
--public void setAccountName(java.lang.String accountName)-
-
-
- Sets the account name.
-
-
-
-
- Parameters:
accountName- the new account name
- -
-setRoles
--public void setRoles(java.util.Set roles) - throws AuthenticationException-
-
-
- Sets the roles.
-
-
-
-
- Parameters:
roles- the new roles -- Throws: -
AuthenticationException
- -
-setScreenName
--public void setScreenName(java.lang.String screenName)-
-
-
- Sets the screen name.
-
-
-
-
- Parameters:
screenName- the new screen name
- -
-unlock
--public void unlock()-
-
-
- Unlock account.
-
-
-
-
- -
-verifyPassword
--public boolean verifyPassword(java.lang.String password) - throws EncryptionException-
-
-
- Verify that the supplied password matches the password for this user. This method
- is typically used for "reauthentication" for the most sensitive functions, such
- as transactions, changing email address, and changing other account information.
-
-
-
-
- Parameters:
password- -- Returns:
- -
- Throws: -
EncryptionException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/IValidator.html b/javadoc/org/owasp/esapi/interfaces/IValidator.html deleted file mode 100644 index ea98de99b..000000000 --- a/javadoc/org/owasp/esapi/interfaces/IValidator.html +++ /dev/null @@ -1,1322 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.interfaces
-
-Interface IValidator
--
-
- All Known Implementing Classes:
- Validator -
-
-
-
- public interface IValidator
-The IValidator interface defines a set of methods for canonicalizing and - validating untrusted input. Implementors should feel free to extend this - interface to accomodate their own data formats. Rather than throw exceptions, - this interface returns boolean results because not all validation problems - are security issues. Boolean returns allow developers to handle both valid - and invalid results more cleanly than exceptions. -
-
-
- Implementations must adopt a "whitelist" approach to validation where a - specific pattern or character set is matched. "Blacklist" approaches that - attempt to identify the invalid or disallowed characters are much more likely - to allow a bypass with encoding or other tricks. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- -
| -Method Summary | -|
- void |
-assertIsValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- void |
-assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- void |
-assertValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Validates the filepath, filename, and content of a file. |
-
- java.lang.String |
-getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- java.util.Date |
-getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns a valid date as a Date. |
-
- java.lang.String |
-getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- java.lang.Double |
-getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns a validated real number as a double. |
-
- byte[] |
-getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns validated file content as a byte array. |
-
- java.lang.String |
-getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated file name as a String. |
-
- java.lang.String |
-getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated input as a String. |
-
- java.lang.Integer |
-getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns a validated integer as an int. |
-
- java.lang.String |
-getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- java.lang.Double |
-getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- byte[] |
-getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a byte array. |
-
- java.lang.String |
-getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a String. |
-
- java.lang.String |
-getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated redirect location as a String. |
-
- java.lang.String |
-getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated "safe" HTML. |
-
- boolean |
-isValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid credit card. |
-
- boolean |
-isValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns true if input is a valid date according to the specified date format. |
-
- boolean |
-isValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid directory path. |
-
- boolean |
-isValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid double. |
-
- boolean |
-isValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if input is valid file content. |
-
- boolean |
-isValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid file name. |
-
- boolean |
-isValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if a file upload has a valid name, path, and content. |
-
- boolean |
-isValidHTTPRequest()
-
-- Validate the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- boolean |
-isValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Returns true if the parameters in the current request contain all required parameters and only optional ones in addition. |
-
- boolean |
-isValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input is valid according to the specified type. |
-
- boolean |
-isValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid integer. |
-
- boolean |
-isValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns true if input is a valid list item. |
-
- boolean |
-isValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid number. |
-
- boolean |
-isValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input is valid printable ASCII characters. |
-
- boolean |
-isValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input is valid printable ASCII characters (32-126). |
-
- boolean |
-isValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid redirect location. |
-
- boolean |
-isValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input is "safe" HTML. |
-
- java.lang.String |
-safeReadLine(java.io.InputStream inputStream,
- int maxLength)
-
-- Reads from an input stream until end-of-line or a maximum number of - characters. |
-
| -Method Detail | -
-isValidInput
--public boolean isValidInput(java.lang.String context, - java.lang.String input, - java.lang.String type, - int maxLength, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is valid according to the specified type. The type parameter must be the name
- of a defined type in the ESAPI configuration or a valid regular expression. Implementers should take
- care to make the type storage simple to understand and configure.
-
-
-
-
- Parameters:
context- A descriptive name for the field to validate. This is used for error facing validation messages and element identification.input- The actual user input data to validate.type- The regular expression name while maps to the actual regular expression from "ESAPI.properties".maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then a input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- The canonicalized user input. -
- Throws: -
IntrusionException
- -
-getValidInput
--public java.lang.String getValidInput(java.lang.String context, - java.lang.String input, - java.lang.String type, - int maxLength, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns canonicalized and validated input as a String. Invalid input will generate a descriptive ValidationException,
- and input that is clearly an attack will generate a descriptive IntrusionException.
-
-
-
-
- Parameters:
context- A descriptive name for the field to validate. This is used for error facing validation messages and element identification.input- The actual user input data to validate.type- The regular expression name while maps to the actual regular expression from "ESAPI.properties".maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then a input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- The canonicalized user input. -
- Throws: -
ValidationException-IntrusionException
- -
-isValidDate
--public boolean isValidDate(java.lang.String context, - java.lang.String input, - java.text.DateFormat format, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid date according to the specified date format.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-getValidDate
--public java.util.Date getValidDate(java.lang.String context, - java.lang.String input, - java.text.DateFormat format, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a valid date as a Date. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidSafeHTML
--public boolean isValidSafeHTML(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is "safe" HTML. Implementors should reference the OWASP AntiSamy project for ideas
- on how to do HTML validation in a whitelist way, as this is an extremely difficult problem.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-getValidSafeHTML
--public java.lang.String getValidSafeHTML(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull) - throws ValidationException-
-
-
- Returns canonicalized and validated "safe" HTML. Implementors should reference the OWASP AntiSamy project for ideas
- on how to do HTML validation in a whitelist way, as this is an extremely difficult problem.
-
-
-
-
-
- Throws: -
ValidationException
- -
-isValidCreditCard
--public boolean isValidCreditCard(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid credit card. Maxlength is mandated by valid credit card type.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-getValidCreditCard
--public java.lang.String getValidCreditCard(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a canonicalized and validated credit card number as a String. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidDirectoryPath
--public boolean isValidDirectoryPath(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid directory path.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-getValidDirectoryPath
--public java.lang.String getValidDirectoryPath(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a canonicalized and validated directory path as a String. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidFileName
--public boolean isValidFileName(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid file name.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-getValidFileName
--public java.lang.String getValidFileName(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a canonicalized and validated file name as a String. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidNumber
--public boolean isValidNumber(java.lang.String context, - java.lang.String input, - long minValue, - long maxValue, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid number.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-getValidNumber
--public java.lang.Double getValidNumber(java.lang.String context, - java.lang.String input, - long minValue, - long maxValue, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a validated number as a double. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidInteger
--public boolean isValidInteger(java.lang.String context, - java.lang.String input, - int minValue, - int maxValue, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid integer.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-getValidInteger
--public java.lang.Integer getValidInteger(java.lang.String context, - java.lang.String input, - int minValue, - int maxValue, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a validated integer as an int. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidDouble
--public boolean isValidDouble(java.lang.String context, - java.lang.String input, - double minValue, - double maxValue, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid double.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-getValidDouble
--public java.lang.Double getValidDouble(java.lang.String context, - java.lang.String input, - double minValue, - double maxValue, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a validated real number as a double. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidFileContent
--public boolean isValidFileContent(java.lang.String context, - byte[] input, - int maxBytes, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is valid file content.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-getValidFileContent
--public byte[] getValidFileContent(java.lang.String context, - byte[] input, - int maxBytes, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns validated file content as a byte array. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidFileUpload
--public boolean isValidFileUpload(java.lang.String context, - java.lang.String filepath, - java.lang.String filename, - byte[] content, - int maxBytes, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if a file upload has a valid name, path, and content.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-assertValidFileUpload
--public void assertValidFileUpload(java.lang.String context, - java.lang.String filepath, - java.lang.String filename, - byte[] content, - int maxBytes, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Validates the filepath, filename, and content of a file. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidHTTPRequest
--public boolean isValidHTTPRequest() - throws IntrusionException-
-
-
- Validate the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed
- characters. See the SecurityConfiguration class for the methods to retrieve the whitelists.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-assertIsValidHTTPRequest
--public void assertIsValidHTTPRequest() - throws ValidationException, - IntrusionException-
-
-
- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed
- characters. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidListItem
--public boolean isValidListItem(java.lang.String context, - java.lang.String input, - java.util.List list) - throws IntrusionException-
-
-
- Returns true if input is a valid list item.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-getValidListItem
--public java.lang.String getValidListItem(java.lang.String context, - java.lang.String input, - java.util.List list) - throws ValidationException, - IntrusionException-
-
-
- Returns the list item that exactly matches the canonicalized input. Invalid or non-matching input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidHTTPRequestParameterSet
--public boolean isValidHTTPRequestParameterSet(java.lang.String context, - java.util.Set required, - java.util.Set optional) - throws IntrusionException-
-
-
- Returns true if the parameters in the current request contain all required parameters and only optional ones in addition.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-assertIsValidHTTPRequestParameterSet
--public void assertIsValidHTTPRequestParameterSet(java.lang.String context, - java.util.Set required, - java.util.Set optional) - throws ValidationException, - IntrusionException-
-
-
- Validates that the parameters in the current request contain all required parameters and only optional ones in
- addition. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidPrintable
--public boolean isValidPrintable(java.lang.String context, - byte[] input, - int maxLength, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is valid printable ASCII characters.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-getValidPrintable
--public byte[] getValidPrintable(java.lang.String context, - byte[] input, - int maxLength, - boolean allowNull) - throws ValidationException-
-
-
- Returns canonicalized and validated printable characters as a byte array. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException
- -
-isValidPrintable
--public boolean isValidPrintable(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is valid printable ASCII characters (32-126).
-
-
-
-
-
- Throws: -
IntrusionException
- -
-getValidPrintable
--public java.lang.String getValidPrintable(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull) - throws ValidationException-
-
-
- Returns canonicalized and validated printable characters as a String. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException
- -
-isValidRedirectLocation
--public boolean isValidRedirectLocation(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid redirect location.
-
-
-
-
-
- Throws: -
IntrusionException
- -
-getValidRedirectLocation
--public java.lang.String getValidRedirectLocation(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws ValidationException-
-
-
- Returns a canonicalized and validated redirect location as a String. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
- Throws: -
ValidationException
- -
-safeReadLine
--public java.lang.String safeReadLine(java.io.InputStream inputStream, - int maxLength) - throws ValidationException-
-
-
- Reads from an input stream until end-of-line or a maximum number of
- characters. This method protects against the inherent denial of service
- attack in reading until the end of a line. If an attacker doesn't ever
- send a newline character, then a normal input stream reader will read
- until all memory is exhausted and the platform throws an OutOfMemoryError
- and probably terminates.
-
-
-
-
-
- Throws: -
ValidationException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/IAccessController.html b/javadoc/org/owasp/esapi/interfaces/class-use/IAccessController.html deleted file mode 100644 index d3412c569..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/IAccessController.html +++ /dev/null @@ -1,204 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.IAccessController
-| -Packages that use IAccessController | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| -Uses of IAccessController in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement IAccessController | -|
- class |
-AccessController
-
-- Reference implementation of the IAccessController interface. |
-
- -
| Methods in org.owasp.esapi that return IAccessController | -|
-static IAccessController |
-ESAPI.accessController()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type IAccessController | -|
-static void |
-ESAPI.setAccessController(IAccessController accessController)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/IAccessReferenceMap.html b/javadoc/org/owasp/esapi/interfaces/class-use/IAccessReferenceMap.html deleted file mode 100644 index e61bb7fc9..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/IAccessReferenceMap.html +++ /dev/null @@ -1,172 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.IAccessReferenceMap
-| -Packages that use IAccessReferenceMap | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| -Uses of IAccessReferenceMap in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement IAccessReferenceMap | -|
- class |
-AccessReferenceMap
-
-- Reference implementation of the IAccessReferenceMap interface. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/IAuthenticator.html b/javadoc/org/owasp/esapi/interfaces/class-use/IAuthenticator.html deleted file mode 100644 index 36ea49a21..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/IAuthenticator.html +++ /dev/null @@ -1,204 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.IAuthenticator
-| -Packages that use IAuthenticator | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| -Uses of IAuthenticator in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement IAuthenticator | -|
- class |
-Authenticator
-
-- Reference implementation of the IAuthenticator interface. |
-
- -
| Methods in org.owasp.esapi that return IAuthenticator | -|
-static IAuthenticator |
-ESAPI.authenticator()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type IAuthenticator | -|
-static void |
-ESAPI.setAuthenticator(IAuthenticator authenticator)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/IEncoder.html b/javadoc/org/owasp/esapi/interfaces/class-use/IEncoder.html deleted file mode 100644 index 02f61e116..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/IEncoder.html +++ /dev/null @@ -1,204 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.IEncoder
-| -Packages that use IEncoder | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| -Uses of IEncoder in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement IEncoder | -|
- class |
-Encoder
-
-- Reference implementation of the IEncoder interface. |
-
- -
| Methods in org.owasp.esapi that return IEncoder | -|
-static IEncoder |
-ESAPI.encoder()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type IEncoder | -|
-static void |
-ESAPI.setEncoder(IEncoder encoder)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/IEncryptedProperties.html b/javadoc/org/owasp/esapi/interfaces/class-use/IEncryptedProperties.html deleted file mode 100644 index 3a22d48c4..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/IEncryptedProperties.html +++ /dev/null @@ -1,172 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.IEncryptedProperties
-| -Packages that use IEncryptedProperties | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| -Uses of IEncryptedProperties in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement IEncryptedProperties | -|
- class |
-EncryptedProperties
-
-- Reference implementation of the IEncryptedProperties interface. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/IEncryptor.html b/javadoc/org/owasp/esapi/interfaces/class-use/IEncryptor.html deleted file mode 100644 index ee9e7f9d1..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/IEncryptor.html +++ /dev/null @@ -1,204 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.IEncryptor
-| -Packages that use IEncryptor | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| -Uses of IEncryptor in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement IEncryptor | -|
- class |
-Encryptor
-
-- Reference implementation of the IEncryptor interface. |
-
- -
| Methods in org.owasp.esapi that return IEncryptor | -|
-static IEncryptor |
-ESAPI.encryptor()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type IEncryptor | -|
-static void |
-ESAPI.setEncryptor(IEncryptor encryptor)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/IExecutor.html b/javadoc/org/owasp/esapi/interfaces/class-use/IExecutor.html deleted file mode 100644 index c00cc8ba5..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/IExecutor.html +++ /dev/null @@ -1,204 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.IExecutor
-| -Packages that use IExecutor | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| -Uses of IExecutor in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement IExecutor | -|
- class |
-Executor
-
-- Reference implementation of the Executor interface. |
-
- -
| Methods in org.owasp.esapi that return IExecutor | -|
-static IExecutor |
-ESAPI.executor()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type IExecutor | -|
-static void |
-ESAPI.setExecutor(IExecutor executor)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/IHTTPUtilities.html b/javadoc/org/owasp/esapi/interfaces/class-use/IHTTPUtilities.html deleted file mode 100644 index ac291abe2..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/IHTTPUtilities.html +++ /dev/null @@ -1,204 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.IHTTPUtilities
-| -Packages that use IHTTPUtilities | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| -Uses of IHTTPUtilities in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement IHTTPUtilities | -|
- class |
-HTTPUtilities
-
-- Reference implementation of the IHTTPUtilities interface. |
-
- -
| Methods in org.owasp.esapi that return IHTTPUtilities | -|
-static IHTTPUtilities |
-ESAPI.httpUtilities()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type IHTTPUtilities | -|
-static void |
-ESAPI.setHttpUtilities(IHTTPUtilities httpUtilities)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/IIntrusionDetector.html b/javadoc/org/owasp/esapi/interfaces/class-use/IIntrusionDetector.html deleted file mode 100644 index 6d2a294e3..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/IIntrusionDetector.html +++ /dev/null @@ -1,204 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.IIntrusionDetector
-| -Packages that use IIntrusionDetector | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| -Uses of IIntrusionDetector in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement IIntrusionDetector | -|
- class |
-IntrusionDetector
-
-- Reference implementation of the IIntrusionDetector interface. |
-
- -
| Methods in org.owasp.esapi that return IIntrusionDetector | -|
-static IIntrusionDetector |
-ESAPI.intrusionDetector()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type IIntrusionDetector | -|
-static void |
-ESAPI.setIntrusionDetector(IIntrusionDetector intrusionDetector)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/ILogFactory.html b/javadoc/org/owasp/esapi/interfaces/class-use/ILogFactory.html deleted file mode 100644 index f7f92c38c..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/ILogFactory.html +++ /dev/null @@ -1,188 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.ILogFactory
-| -Packages that use ILogFactory | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| -Uses of ILogFactory in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement ILogFactory | -|
- class |
-JavaLogFactory
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type ILogFactory | -|
-static void |
-ESAPI.setLogger(ILogFactory factory)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/ILogger.html b/javadoc/org/owasp/esapi/interfaces/class-use/ILogger.html deleted file mode 100644 index 0a7bca78f..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/ILogger.html +++ /dev/null @@ -1,310 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.ILogger
-| -Packages that use ILogger | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| org.owasp.esapi.interfaces | -A set of interfaces modeling the most important security functions to -enterprise web applications. | -
| -Uses of ILogger in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement ILogger | -|
- class |
-Logger
-
-- Reference implementation of the ILogger interface. |
-
- -
| Methods in org.owasp.esapi that return ILogger | -|
- ILogger |
-JavaLogFactory.getLogger(java.lang.Class clazz)
-
-- |
-
- ILogger |
-JavaLogFactory.getLogger(java.lang.String name)
-
-- |
-
-static ILogger |
-ESAPI.getLogger(java.lang.Class clazz)
-
-- |
-
-static ILogger |
-ESAPI.getLogger(java.lang.String name)
-
-- |
-
-static ILogger |
-ESAPI.log()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type ILogger | -|
- void |
-HTTPUtilities.logHTTPRequest(ILogger logger)
-
-- |
-
- void |
-HTTPUtilities.logHTTPRequest(ILogger logger,
- java.util.List parameterNamesToObfuscate)
-
-- Formats an HTTP request into a log suitable string. |
-
| -Uses of ILogger in org.owasp.esapi.interfaces | -
- -
| Methods in org.owasp.esapi.interfaces that return ILogger | -|
- ILogger |
-ILogFactory.getLogger(java.lang.String name)
-
-- |
-
- ILogger |
-ILogFactory.getLogger(java.lang.Class clazz)
-
-- |
-
- -
| Methods in org.owasp.esapi.interfaces with parameters of type ILogger | -|
- void |
-IHTTPUtilities.logHTTPRequest(ILogger logger)
-
-- Format the Source IP address, URL, URL parameters, and all form - parameters into a string suitable for the log file. |
-
- void |
-IHTTPUtilities.logHTTPRequest(ILogger logger,
- java.util.List parameterNamesToObfuscate)
-
-- Format the Source IP address, URL, URL parameters, and all form - parameters into a string suitable for the log file. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/IRandomizer.html b/javadoc/org/owasp/esapi/interfaces/class-use/IRandomizer.html deleted file mode 100644 index 30a5bd6fe..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/IRandomizer.html +++ /dev/null @@ -1,204 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.IRandomizer
-| -Packages that use IRandomizer | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| -Uses of IRandomizer in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement IRandomizer | -|
- class |
-Randomizer
-
-- Reference implementation of the IRandomizer interface. |
-
- -
| Methods in org.owasp.esapi that return IRandomizer | -|
-static IRandomizer |
-ESAPI.randomizer()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type IRandomizer | -|
-static void |
-ESAPI.setRandomizer(IRandomizer randomizer)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/ISecurityConfiguration.html b/javadoc/org/owasp/esapi/interfaces/class-use/ISecurityConfiguration.html deleted file mode 100644 index a051f07cd..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/ISecurityConfiguration.html +++ /dev/null @@ -1,204 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.ISecurityConfiguration
-| -Packages that use ISecurityConfiguration | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| -Uses of ISecurityConfiguration in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement ISecurityConfiguration | -|
- class |
-SecurityConfiguration
-
-- The SecurityConfiguration manages all the settings used by the ESAPI in a single place. |
-
- -
| Methods in org.owasp.esapi that return ISecurityConfiguration | -|
-static ISecurityConfiguration |
-ESAPI.securityConfiguration()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type ISecurityConfiguration | -|
-static void |
-ESAPI.setSecurityConfiguration(ISecurityConfiguration securityConfiguration)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/IUser.html b/javadoc/org/owasp/esapi/interfaces/class-use/IUser.html deleted file mode 100644 index 6e4a134ab..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/IUser.html +++ /dev/null @@ -1,349 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.IUser
-| -Packages that use IUser | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| org.owasp.esapi.interfaces | -A set of interfaces modeling the most important security functions to -enterprise web applications. | -
| -Uses of IUser in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement IUser | -|
- class |
-User
-
-- Reference implementation of the IUser interface. |
-
- -
| Methods in org.owasp.esapi that return IUser | -|
- IUser |
-Authenticator.createUser(java.lang.String accountName,
- java.lang.String password1,
- java.lang.String password2)
-
-- |
-
- IUser |
-Authenticator.getCurrentUser()
-
-- |
-
- IUser |
-Authenticator.getUser(java.lang.String accountName)
-
-- Gets the user object with the matching account name or null if there is no match. |
-
- IUser |
-Authenticator.getUserFromSession()
-
-- Gets the user from session. |
-
- IUser |
-Authenticator.login(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- This method should be called for every HTTP request, to login the current user either from the session of HTTP - request. |
-
- -
| Methods in org.owasp.esapi with parameters of type IUser | -|
- java.lang.String |
-Authenticator.generateStrongPassword(java.lang.String oldPassword,
- IUser user)
-
-- |
-
- void |
-Authenticator.setCurrentUser(IUser user)
-
-- |
-
| -Uses of IUser in org.owasp.esapi.interfaces | -
- -
| Fields in org.owasp.esapi.interfaces declared as IUser | -|
-static IUser |
-IUser.ANONYMOUS
-
-- |
-
- -
| Methods in org.owasp.esapi.interfaces that return IUser | -|
- IUser |
-IAuthenticator.login(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- Authenticates the user's credentials from the HttpServletRequest if - necessary, creates a session if necessary, and sets the user as the - current user. |
-
- IUser |
-IAuthenticator.createUser(java.lang.String accountName,
- java.lang.String password1,
- java.lang.String password2)
-
-- Creates the user. |
-
- IUser |
-IAuthenticator.getUser(java.lang.String accountName)
-
-- Returns the User matching the provided accountName. |
-
- IUser |
-IAuthenticator.getCurrentUser()
-
-- Returns the currently logged in User. |
-
- -
| Methods in org.owasp.esapi.interfaces with parameters of type IUser | -|
- java.lang.String |
-IAuthenticator.generateStrongPassword(java.lang.String oldPassword,
- IUser user)
-
-- Generate strong password that takes into account the user's information and old password. |
-
- void |
-IAuthenticator.setCurrentUser(IUser user)
-
-- Sets the currently logged in User. |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/class-use/IValidator.html b/javadoc/org/owasp/esapi/interfaces/class-use/IValidator.html deleted file mode 100644 index 4bc76ff53..000000000 --- a/javadoc/org/owasp/esapi/interfaces/class-use/IValidator.html +++ /dev/null @@ -1,204 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Interface
org.owasp.esapi.interfaces.IValidator
-| -Packages that use IValidator | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| -Uses of IValidator in org.owasp.esapi | -
- -
| Classes in org.owasp.esapi that implement IValidator | -|
- class |
-Validator
-
-- Reference implementation of the IValidator interface. |
-
- -
| Methods in org.owasp.esapi that return IValidator | -|
-static IValidator |
-ESAPI.validator()
-
-- |
-
- -
| Methods in org.owasp.esapi with parameters of type IValidator | -|
-static void |
-ESAPI.setValidator(IValidator validator)
-
-- |
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/doc-files/AccessController.jpg b/javadoc/org/owasp/esapi/interfaces/doc-files/AccessController.jpg deleted file mode 100644 index 414d6a167..000000000 Binary files a/javadoc/org/owasp/esapi/interfaces/doc-files/AccessController.jpg and /dev/null differ diff --git a/javadoc/org/owasp/esapi/interfaces/doc-files/AccessReferenceMap.jpg b/javadoc/org/owasp/esapi/interfaces/doc-files/AccessReferenceMap.jpg deleted file mode 100644 index c9611c365..000000000 Binary files a/javadoc/org/owasp/esapi/interfaces/doc-files/AccessReferenceMap.jpg and /dev/null differ diff --git a/javadoc/org/owasp/esapi/interfaces/doc-files/Authenticator.jpg b/javadoc/org/owasp/esapi/interfaces/doc-files/Authenticator.jpg deleted file mode 100644 index af40202c7..000000000 Binary files a/javadoc/org/owasp/esapi/interfaces/doc-files/Authenticator.jpg and /dev/null differ diff --git a/javadoc/org/owasp/esapi/interfaces/doc-files/HTTPUtilities.jpg b/javadoc/org/owasp/esapi/interfaces/doc-files/HTTPUtilities.jpg deleted file mode 100644 index f114d52e7..000000000 Binary files a/javadoc/org/owasp/esapi/interfaces/doc-files/HTTPUtilities.jpg and /dev/null differ diff --git a/javadoc/org/owasp/esapi/interfaces/doc-files/IntrusionDetector.jpg b/javadoc/org/owasp/esapi/interfaces/doc-files/IntrusionDetector.jpg deleted file mode 100644 index 78a334585..000000000 Binary files a/javadoc/org/owasp/esapi/interfaces/doc-files/IntrusionDetector.jpg and /dev/null differ diff --git a/javadoc/org/owasp/esapi/interfaces/doc-files/Validator.jpg b/javadoc/org/owasp/esapi/interfaces/doc-files/Validator.jpg deleted file mode 100644 index 72fd9c979..000000000 Binary files a/javadoc/org/owasp/esapi/interfaces/doc-files/Validator.jpg and /dev/null differ diff --git a/javadoc/org/owasp/esapi/interfaces/package-frame.html b/javadoc/org/owasp/esapi/interfaces/package-frame.html deleted file mode 100644 index 0d303dd35..000000000 --- a/javadoc/org/owasp/esapi/interfaces/package-frame.html +++ /dev/null @@ -1,60 +0,0 @@ - - - - - -
|
-Interfaces
-
- -IAccessController - -IAccessReferenceMap - -IAuthenticator - -IEncoder - -IEncryptedProperties - -IEncryptor - -IExecutor - -IHTTPUtilities - -IIntrusionDetector - -ILogFactory - -ILogger - -IRandomizer - -ISecurityConfiguration - -IUser - -IValidator |
-
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Package org.owasp.esapi.interfaces -
-A set of interfaces modeling the most important security functions to -enterprise web applications. -
-See:
-
- Description
-
- -
| -Interface Summary | -|
| IAccessController | -The IAccessController interface defines a set of methods that can be used in a wide variety of applications to - enforce access control. | -
| IAccessReferenceMap | -The IAccessReferenceMap interface is used to map from a set of internal - direct object references to a set of indirect references that are safe to - disclose publically. | -
| IAuthenticator | -The IAuthenticator interface defines a set of methods for generating and - handling account credentials and session identifiers. | -
| IEncoder | -The IEncoder interface contains a number of methods related to encoding input - so that it will be safe for a variety of interpreters. | -
| IEncryptedProperties | -The IEncryptedProperties interface is a properties file where all the data is - encrypted before it is added, and decrypted when it retrieved. | -
| IEncryptor | -The IEncryptor interface provides a set of methods for performing common - encryption, random number, and hashing operations. | -
| IExecutor | -The Executor interface is used to run an OS command with less security risk. | -
| IHTTPUtilities | -The IHTTPUtilities interface is a collection of methods that provide additional security related to HTTP requests, - responses, sessions, cookies, headers, and logging. | -
| IIntrusionDetector | -The IIntrusionDetector interface is intended to track security relevant events and identify attack behavior. | -
| ILogFactory | -- |
| ILogger | -The ILogger interface defines a set of methods that can be used to log - security events. | -
| IRandomizer | -The IRandomizer interface defines a set of methods for creating - cryptographically random numbers and strings. | -
| ISecurityConfiguration | -The ISecurityConfiguration interface stores all configuration information - that directs the behavior of the ESAPI implementation. | -
| IUser | -The IUser interface represents an application user or user account. | -
| IValidator | -The IValidator interface defines a set of methods for canonicalizing and - validating untrusted input. | -
-Package org.owasp.esapi.interfaces Description -
- --A set of interfaces modeling the most important security functions to -enterprise web applications. The interfaces in this package are intended -to be extended and customized within an enterprise to match their custom -data, security services, and application environment. A reference -implementation of this interface is provided as an example of how this -library can be implemented successfully. -
- -
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/package-tree.html b/javadoc/org/owasp/esapi/interfaces/package-tree.html deleted file mode 100644 index c3a63916d..000000000 --- a/javadoc/org/owasp/esapi/interfaces/package-tree.html +++ /dev/null @@ -1,143 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Hierarchy For Package org.owasp.esapi.interfaces -
--
-
- Package Hierarchies:
- All Packages
-
-Interface Hierarchy -
--
-
- interface org.owasp.esapi.interfaces.IAccessController
- interface org.owasp.esapi.interfaces.IAccessReferenceMap
- interface org.owasp.esapi.interfaces.IAuthenticator
- interface org.owasp.esapi.interfaces.IEncoder
- interface org.owasp.esapi.interfaces.IEncryptedProperties
- interface org.owasp.esapi.interfaces.IEncryptor
- interface org.owasp.esapi.interfaces.IExecutor
- interface org.owasp.esapi.interfaces.IHTTPUtilities
- interface org.owasp.esapi.interfaces.IIntrusionDetector
- interface org.owasp.esapi.interfaces.ILogFactory
- interface org.owasp.esapi.interfaces.ILogger
- interface org.owasp.esapi.interfaces.IRandomizer
- interface org.owasp.esapi.interfaces.ISecurityConfiguration
- interface org.owasp.esapi.interfaces.IUser
- interface org.owasp.esapi.interfaces.IValidator
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/interfaces/package-use.html b/javadoc/org/owasp/esapi/interfaces/package-use.html deleted file mode 100644 index fd5a8b00f..000000000 --- a/javadoc/org/owasp/esapi/interfaces/package-use.html +++ /dev/null @@ -1,285 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Package
org.owasp.esapi.interfaces
-| -Packages that use org.owasp.esapi.interfaces | -|
| org.owasp.esapi | -Reference implementations of the ESAPI interfaces. | -
| org.owasp.esapi.interfaces | -A set of interfaces modeling the most important security functions to -enterprise web applications. | -
| -Classes in org.owasp.esapi.interfaces used by org.owasp.esapi | -|
| IAccessController
-
- - The IAccessController interface defines a set of methods that can be used in a wide variety of applications to - enforce access control. |
-|
| IAccessReferenceMap
-
- - The IAccessReferenceMap interface is used to map from a set of internal - direct object references to a set of indirect references that are safe to - disclose publically. |
-|
| IAuthenticator
-
- - The IAuthenticator interface defines a set of methods for generating and - handling account credentials and session identifiers. |
-|
| IEncoder
-
- - The IEncoder interface contains a number of methods related to encoding input - so that it will be safe for a variety of interpreters. |
-|
| IEncryptedProperties
-
- - The IEncryptedProperties interface is a properties file where all the data is - encrypted before it is added, and decrypted when it retrieved. |
-|
| IEncryptor
-
- - The IEncryptor interface provides a set of methods for performing common - encryption, random number, and hashing operations. |
-|
| IExecutor
-
- - The Executor interface is used to run an OS command with less security risk. |
-|
| IHTTPUtilities
-
- - The IHTTPUtilities interface is a collection of methods that provide additional security related to HTTP requests, - responses, sessions, cookies, headers, and logging. |
-|
| IIntrusionDetector
-
- - The IIntrusionDetector interface is intended to track security relevant events and identify attack behavior. |
-|
| ILogFactory
-
- - |
-|
| ILogger
-
- - The ILogger interface defines a set of methods that can be used to log - security events. |
-|
| IRandomizer
-
- - The IRandomizer interface defines a set of methods for creating - cryptographically random numbers and strings. |
-|
| ISecurityConfiguration
-
- - The ISecurityConfiguration interface stores all configuration information - that directs the behavior of the ESAPI implementation. |
-|
| IUser
-
- - The IUser interface represents an application user or user account. |
-|
| IValidator
-
- - The IValidator interface defines a set of methods for canonicalizing and - validating untrusted input. |
-|
| -Classes in org.owasp.esapi.interfaces used by org.owasp.esapi.interfaces | -|
| ILogger
-
- - The ILogger interface defines a set of methods that can be used to log - security events. |
-|
| IUser
-
- - The IUser interface represents an application user or user account. |
-|
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/package-frame.html b/javadoc/org/owasp/esapi/package-frame.html deleted file mode 100644 index 5e9e6efd9..000000000 --- a/javadoc/org/owasp/esapi/package-frame.html +++ /dev/null @@ -1,83 +0,0 @@ - - - - - -
|
-Interfaces
-
- -AccessController - -AccessReferenceMap - -Authenticator - -Encoder - -EncryptedProperties - -Encryptor - -Executor - -HTTPUtilities - -IntrusionDetector - -LogFactory - -Logger - -Randomizer - -SecurityConfiguration - -User - -Validator |
-
|
-Classes
-
- -AllTests - -ESAPI - -ESAPITest - -SafeFile - -SecurityConfiguration.Threshold - -StringUtilities - -ValidationErrorList |
-
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Package org.owasp.esapi -
-The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. -
-See:
-
- Description
-
- -
| -Interface Summary | -|
| AccessController | -The IAccessController interface defines a set of methods that can be used in a wide variety of applications to - enforce access control. | -
| AccessReferenceMap | -The AccessReferenceMap interface is used to map from a set of internal - direct object references to a set of indirect references that are safe to - disclose publicly. | -
| Authenticator | -The Authenticator interface defines a set of methods for generating and - handling account credentials and session identifiers. | -
| Encoder | -The Encoder interface contains a number of methods related to encoding input - so that it will be safe for a variety of interpreters. | -
| EncryptedProperties | -The EncryptedProperties interface represents a properties file where all the data is - encrypted before it is added, and decrypted when it retrieved. | -
| Encryptor | -The Encryptor interface provides a set of methods for performing common - encryption, random number, and hashing operations. | -
| Executor | -The Executor interface is used to run an OS command with reduced security risk. | -
| HTTPUtilities | -The HTTPUtilities interface is a collection of methods that provide additional security related to HTTP requests, - responses, sessions, cookies, headers, and logging. | -
| IntrusionDetector | -The IntrusionDetector interface is intended to track security relevant events and identify attack behavior. | -
| LogFactory | -The LogFactory interface is intended to allow substitution of various logging packages, while providing - a common interface to access them. | -
| Logger | -The Logger interface defines a set of methods that can be used to log - security events. | -
| Randomizer | -The IRandomizer interface defines a set of methods for creating - cryptographically random numbers and strings. | -
| SecurityConfiguration | -The ISecurityConfiguration interface stores all configuration information - that directs the behavior of the ESAPI implementation. | -
| User | -The User interface represents an application user or user account. | -
| Validator | -The Validator interface defines a set of methods for canonicalizing and - validating untrusted input. | -
- -
| -Class Summary | -|
| AllTests | -The Class AllTests. | -
| ESAPI | -ESAPI locator class to make it easy to get a concrete implementation of the - various ESAPI classes. | -
| ESAPITest | -The Class ExecutorTest. | -
| SafeFile | -Extension to java.io.File to prevent against null byte injections and - other unforeseen problems resulting from unprintable characters - causing problems in path lookups. | -
| SecurityConfiguration.Threshold | -Models a simple threshold as a count and an interval, along with a set of actions to take if the threshold is exceeded. | -
| StringUtilities | -String utilities used in various filters. | -
| ValidationErrorList | -The ValidationErrorList class defines a well-formed collection of - ValidationExceptions so that groups of validation functions can be - called in a non-blocking fashion. | -
-Package org.owasp.esapi Description -
- --The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. The interfaces in this package are -intended to be extended and customized within an enterprise to match their -custom data, security services, and application environment. A reference -implementation of this interface is provided as an example of how this -library can be implemented successfully. - -
References
- -This library builds on some of the ideas found in: - -- -
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/package-tree.html b/javadoc/org/owasp/esapi/package-tree.html deleted file mode 100644 index 57365eec6..000000000 --- a/javadoc/org/owasp/esapi/package-tree.html +++ /dev/null @@ -1,160 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Hierarchy For Package org.owasp.esapi -
--
-
- Package Hierarchies:
- All Packages
-
-Class Hierarchy -
--
-
- class java.lang.Object
-
-
- class junit.framework.Assert -
- class org.owasp.esapi.ESAPI
- class java.io.File (implements java.lang.Comparable, java.io.Serializable)
-
-
-
- class org.owasp.esapi.SafeFile
- class org.owasp.esapi.SecurityConfiguration.Threshold
- class org.owasp.esapi.StringUtilities
- class org.owasp.esapi.ValidationErrorList
-Interface Hierarchy -
--
-
- interface org.owasp.esapi.AccessController
- interface org.owasp.esapi.AccessReferenceMap
- interface org.owasp.esapi.Authenticator
- interface org.owasp.esapi.Encoder
- interface org.owasp.esapi.EncryptedProperties
- interface org.owasp.esapi.Encryptor
- interface org.owasp.esapi.Executor
- interface org.owasp.esapi.HTTPUtilities
- interface org.owasp.esapi.IntrusionDetector
- interface org.owasp.esapi.LogFactory
- interface org.owasp.esapi.Logger
- interface java.security.Principal
-
-
- interface org.owasp.esapi.User
- interface org.owasp.esapi.Randomizer
- interface org.owasp.esapi.SecurityConfiguration
- interface org.owasp.esapi.Validator
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/package-use.html b/javadoc/org/owasp/esapi/package-use.html deleted file mode 100644 index 4809cd60f..000000000 --- a/javadoc/org/owasp/esapi/package-use.html +++ /dev/null @@ -1,389 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Package
org.owasp.esapi
-| -Packages that use org.owasp.esapi | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| -Classes in org.owasp.esapi used by org.owasp.esapi | -|
| AccessController
-
- - The IAccessController interface defines a set of methods that can be used in a wide variety of applications to - enforce access control. |
-|
| Authenticator
-
- - The Authenticator interface defines a set of methods for generating and - handling account credentials and session identifiers. |
-|
| Encoder
-
- - The Encoder interface contains a number of methods related to encoding input - so that it will be safe for a variety of interpreters. |
-|
| Encryptor
-
- - The Encryptor interface provides a set of methods for performing common - encryption, random number, and hashing operations. |
-|
| Executor
-
- - The Executor interface is used to run an OS command with reduced security risk. |
-|
| HTTPUtilities
-
- - The HTTPUtilities interface is a collection of methods that provide additional security related to HTTP requests, - responses, sessions, cookies, headers, and logging. |
-|
| IntrusionDetector
-
- - The IntrusionDetector interface is intended to track security relevant events and identify attack behavior. |
-|
| LogFactory
-
- - The LogFactory interface is intended to allow substitution of various logging packages, while providing - a common interface to access them. |
-|
| Logger
-
- - The Logger interface defines a set of methods that can be used to log - security events. |
-|
| Randomizer
-
- - The IRandomizer interface defines a set of methods for creating - cryptographically random numbers and strings. |
-|
| SecurityConfiguration
-
- - The ISecurityConfiguration interface stores all configuration information - that directs the behavior of the ESAPI implementation. |
-|
| SecurityConfiguration.Threshold
-
- - Models a simple threshold as a count and an interval, along with a set of actions to take if the threshold is exceeded. |
-|
| User
-
- - The User interface represents an application user or user account. |
-|
| ValidationErrorList
-
- - The ValidationErrorList class defines a well-formed collection of - ValidationExceptions so that groups of validation functions can be - called in a non-blocking fashion. |
-|
| Validator
-
- - The Validator interface defines a set of methods for canonicalizing and - validating untrusted input. |
-|
| -Classes in org.owasp.esapi used by org.owasp.esapi.reference | -|
| AccessController
-
- - The IAccessController interface defines a set of methods that can be used in a wide variety of applications to - enforce access control. |
-|
| AccessReferenceMap
-
- - The AccessReferenceMap interface is used to map from a set of internal - direct object references to a set of indirect references that are safe to - disclose publicly. |
-|
| Authenticator
-
- - The Authenticator interface defines a set of methods for generating and - handling account credentials and session identifiers. |
-|
| Encoder
-
- - The Encoder interface contains a number of methods related to encoding input - so that it will be safe for a variety of interpreters. |
-|
| EncryptedProperties
-
- - The EncryptedProperties interface represents a properties file where all the data is - encrypted before it is added, and decrypted when it retrieved. |
-|
| Encryptor
-
- - The Encryptor interface provides a set of methods for performing common - encryption, random number, and hashing operations. |
-|
| Executor
-
- - The Executor interface is used to run an OS command with reduced security risk. |
-|
| HTTPUtilities
-
- - The HTTPUtilities interface is a collection of methods that provide additional security related to HTTP requests, - responses, sessions, cookies, headers, and logging. |
-|
| IntrusionDetector
-
- - The IntrusionDetector interface is intended to track security relevant events and identify attack behavior. |
-|
| LogFactory
-
- - The LogFactory interface is intended to allow substitution of various logging packages, while providing - a common interface to access them. |
-|
| Logger
-
- - The Logger interface defines a set of methods that can be used to log - security events. |
-|
| Randomizer
-
- - The IRandomizer interface defines a set of methods for creating - cryptographically random numbers and strings. |
-|
| SecurityConfiguration
-
- - The ISecurityConfiguration interface stores all configuration information - that directs the behavior of the ESAPI implementation. |
-|
| SecurityConfiguration.Threshold
-
- - Models a simple threshold as a count and an interval, along with a set of actions to take if the threshold is exceeded. |
-|
| User
-
- - The User interface represents an application user or user account. |
-|
| ValidationErrorList
-
- - The ValidationErrorList class defines a well-formed collection of - ValidationExceptions so that groups of validation functions can be - called in a non-blocking fashion. |
-|
| Validator
-
- - The Validator interface defines a set of methods for canonicalizing and - validating untrusted input. |
-|
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/AccessControllerTest.html b/javadoc/org/owasp/esapi/reference/AccessControllerTest.html deleted file mode 100644 index dc5e8cc34..000000000 --- a/javadoc/org/owasp/esapi/reference/AccessControllerTest.html +++ /dev/null @@ -1,426 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class AccessControllerTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class AccessControllerTest
- extends junit.framework.TestCase
-The Class AccessControllerTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
AccessControllerTest(java.lang.String testName)
-
-- Instantiates a new access controller test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testIsAuthorizedForBackendService()
-
-- Test of isAuthorizedForBackendService method, of class - org.owasp.esapi.AccessController. |
-
- void |
-testIsAuthorizedForData()
-
-- Test of isAuthorizedForData method, of class - org.owasp.esapi.AccessController. |
-
- void |
-testIsAuthorizedForFile()
-
-- Test of isAuthorizedForFile method, of class - org.owasp.esapi.AccessController. |
-
- void |
-testIsAuthorizedForFunction()
-
-- Test of isAuthorizedForFunction method, of class - org.owasp.esapi.AccessController. |
-
- void |
-testIsAuthorizedForURL()
-
-- Test of isAuthorizedForURL method, of class - org.owasp.esapi.AccessController. |
-
- void |
-testMatchRule()
-
-- |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AccessControllerTest
--public AccessControllerTest(java.lang.String testName) - throws java.lang.Exception-
-
-
- Instantiates a new access controller test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testMatchRule
--public void testMatchRule()-
-
-
-
-
-
- -
-testIsAuthorizedForURL
--public void testIsAuthorizedForURL() - throws java.lang.Exception-
-
-
- Test of isAuthorizedForURL method, of class
- org.owasp.esapi.AccessController.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testIsAuthorizedForFunction
--public void testIsAuthorizedForFunction()-
-
-
- Test of isAuthorizedForFunction method, of class
- org.owasp.esapi.AccessController.
-
-
-
-
- -
-testIsAuthorizedForData
--public void testIsAuthorizedForData()-
-
-
- Test of isAuthorizedForData method, of class
- org.owasp.esapi.AccessController.
-
-
-
-
- -
-testIsAuthorizedForFile
--public void testIsAuthorizedForFile()-
-
-
- Test of isAuthorizedForFile method, of class
- org.owasp.esapi.AccessController.
-
-
-
-
- -
-testIsAuthorizedForBackendService
--public void testIsAuthorizedForBackendService()-
-
-
- Test of isAuthorizedForBackendService method, of class
- org.owasp.esapi.AccessController.
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/AccessReferenceMapTest.html b/javadoc/org/owasp/esapi/reference/AccessReferenceMapTest.html deleted file mode 100644 index 4cc6e7999..000000000 --- a/javadoc/org/owasp/esapi/reference/AccessReferenceMapTest.html +++ /dev/null @@ -1,428 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class AccessReferenceMapTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class AccessReferenceMapTest
- extends junit.framework.TestCase
-The Class AccessReferenceMapTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
AccessReferenceMapTest(java.lang.String testName)
-
-- Instantiates a new access reference map test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testAddDirectReference()
-
-- |
-
- void |
-testGetDirectReference()
-
-- Test of getDirectReference method, of class - org.owasp.esapi.AccessReferenceMap. |
-
- void |
-testGetIndirectReference()
-
-- Test of getIndirectReference method, of class - org.owasp.esapi.AccessReferenceMap. |
-
- void |
-testIterator()
-
-- Test of iterator method, of class org.owasp.esapi.AccessReferenceMap. |
-
- void |
-testRemoveDirectReference()
-
-- |
-
- void |
-testUpdate()
-
-- Test of update method, of class org.owasp.esapi.AccessReferenceMap. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AccessReferenceMapTest
--public AccessReferenceMapTest(java.lang.String testName)-
-
-
- Instantiates a new access reference map test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testUpdate
--public void testUpdate() - throws AuthenticationException, - EncryptionException-
-
-
- Test of update method, of class org.owasp.esapi.AccessReferenceMap.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception -EncryptionException
- -
-testIterator
--public void testIterator()-
-
-
- Test of iterator method, of class org.owasp.esapi.AccessReferenceMap.
-
-
-
-
- -
-testGetIndirectReference
--public void testGetIndirectReference()-
-
-
- Test of getIndirectReference method, of class
- org.owasp.esapi.AccessReferenceMap.
-
-
-
-
- -
-testGetDirectReference
--public void testGetDirectReference() - throws AccessControlException-
-
-
- Test of getDirectReference method, of class
- org.owasp.esapi.AccessReferenceMap.
-
-
-
-
-
- Throws: -
AccessControlException- the access control exception
- -
-testAddDirectReference
--public void testAddDirectReference() - throws AccessControlException-
-
-
-
-
-
- Throws: -
AccessControlException
-
- -
-testRemoveDirectReference
--public void testRemoveDirectReference() - throws AccessControlException-
-
-
-
-
-
- Throws: -
AccessControlException
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/AuthenticatorTest.html b/javadoc/org/owasp/esapi/reference/AuthenticatorTest.html deleted file mode 100644 index 2423f5d88..000000000 --- a/javadoc/org/owasp/esapi/reference/AuthenticatorTest.html +++ /dev/null @@ -1,678 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class AuthenticatorTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class AuthenticatorTest
- extends junit.framework.TestCase
-The Class AuthenticatorTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
AuthenticatorTest(java.lang.String testName)
-
-- Instantiates a new authenticator test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testCreateUser()
-
-- Test of createAccount method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testExists()
-
-- Test of exists method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testGenerateStrongPassword()
-
-- Test of generateStrongPassword method, of class - org.owasp.esapi.Authenticator. |
-
- void |
-testGetCurrentUser()
-
-- Test of getCurrentUser method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testGetUser()
-
-- Test of getUser method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testGetUserFromRememberToken()
-
-- |
-
- void |
-testGetUserFromSession()
-
-- Test get user from session. |
-
- void |
-testGetUserNames()
-
-- Test get user names. |
-
- void |
-testHashPassword()
-
-- Test of hashPassword method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testLogin()
-
-- Test of login method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testMain()
-
-- Test of main method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testRemoveUser()
-
-- Test of removeAccount method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testSaveUsers()
-
-- Test of saveUsers method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testSetCurrentUser()
-
-- Test of setCurrentUser method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testSetCurrentUserWithRequest()
-
-- Test of setCurrentUser method, of class org.owasp.esapi.Authenticator. |
-
- void |
-testValidatePasswordStrength()
-
-- Test of validatePasswordStrength method, of class - org.owasp.esapi.Authenticator. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-AuthenticatorTest
--public AuthenticatorTest(java.lang.String testName)-
-
-
- Instantiates a new authenticator test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testCreateUser
--public void testCreateUser() - throws AuthenticationException, - EncryptionException-
-
-
- Test of createAccount method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception -EncryptionException
- -
-testGenerateStrongPassword
--public void testGenerateStrongPassword() - throws AuthenticationException-
-
-
- Test of generateStrongPassword method, of class
- org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testGetCurrentUser
--public void testGetCurrentUser() - throws java.lang.Exception-
-
-
- Test of getCurrentUser method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
java.lang.InterruptedException- * -AuthenticationException- the authentication exception -java.lang.Exception
- -
-testGetUser
--public void testGetUser() - throws AuthenticationException-
-
-
- Test of getUser method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testGetUserFromRememberToken
--public void testGetUserFromRememberToken() - throws AuthenticationException-
-
-
-
-
-
- Throws: -
AuthenticationException
-
- -
-testGetUserFromSession
--public void testGetUserFromSession() - throws AuthenticationException-
-
-
- Test get user from session.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testGetUserNames
--public void testGetUserNames() - throws AuthenticationException-
-
-
- Test get user names.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testHashPassword
--public void testHashPassword() - throws EncryptionException-
-
-
- Test of hashPassword method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
EncryptionException
- -
-testLogin
--public void testLogin() - throws AuthenticationException-
-
-
- Test of login method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testRemoveUser
--public void testRemoveUser() - throws java.lang.Exception-
-
-
- Test of removeAccount method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testSaveUsers
--public void testSaveUsers() - throws java.lang.Exception-
-
-
- Test of saveUsers method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testSetCurrentUser
--public void testSetCurrentUser() - throws AuthenticationException-
-
-
- Test of setCurrentUser method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testSetCurrentUserWithRequest
--public void testSetCurrentUserWithRequest() - throws AuthenticationException-
-
-
- Test of setCurrentUser method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testValidatePasswordStrength
--public void testValidatePasswordStrength() - throws AuthenticationException-
-
-
- Test of validatePasswordStrength method, of class
- org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testExists
--public void testExists() - throws java.lang.Exception-
-
-
- Test of exists method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testMain
--public void testMain() - throws java.lang.Exception-
-
-
- Test of main method, of class org.owasp.esapi.Authenticator.
-
-
-
-
-
- Throws: -
java.lang.Exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/DefaultEncoder.html b/javadoc/org/owasp/esapi/reference/DefaultEncoder.html deleted file mode 100644 index 67be4e272..000000000 --- a/javadoc/org/owasp/esapi/reference/DefaultEncoder.html +++ /dev/null @@ -1,844 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class DefaultEncoder
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Encoder -
-
-
-
- public class DefaultEncoder
- extends java.lang.Object
- implements Encoder
- extends java.lang.Object
-Reference implementation of the Encoder interface. This implementation takes - a whitelist approach to encoding, meaning that everything not specifically identified in a - list of "immune" characters is encoded. Several methods follow the approach in the Microsoft - AntiXSS Library. -
- The Encoder performs two key functions - The canonicalization algorithm is complex, as it has to be able to recognize - encoded characters that might affect downstream interpreters without being - told what encodings are possible. The stream is read one character at a time. - If an encoded character is encountered, it is canonicalized and pushed back - onto the stream. If the next character is encoded, then a intrusion exception - is thrown for the double-encoding which is assumed to be an attack. -
- The encoding methods also attempt to prevent double encoding, by canonicalizing strings - that are passed to them for encoding. -
- Currently the implementation supports: -
-
-
- HTML Entity Encoding (including non-terminated) -
- Percent Encoding -
- Backslash Encoding -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Encoder
- -
| -Field Summary | -
| Fields inherited from interface org.owasp.esapi.Encoder | -
CHAR_ALPHANUMERICS, CHAR_DIGITS, CHAR_LETTERS, CHAR_LOWERS, CHAR_PASSWORD_DIGITS, CHAR_PASSWORD_LETTERS, CHAR_PASSWORD_LOWERS, CHAR_PASSWORD_SPECIALS, CHAR_PASSWORD_UPPERS, CHAR_SPECIALS, CHAR_UPPERS |
-
| -Constructor Summary | -|
DefaultEncoder()
-
-- |
-|
| -Method Summary | -|
- java.lang.String |
-canonicalize(java.lang.String input)
-
-- Simplifies encoded characters to their - simplest form so that they can be properly validated. |
-
- java.lang.String |
-canonicalize(java.lang.String input,
- boolean strict)
-
-- Strict mode throws an exception when any double encoded data is detected. |
-
- byte[] |
-decodeFromBase64(java.lang.String input)
-
-- Decode data encoded with BASE-64 encoding. |
-
- java.lang.String |
-decodeFromURL(java.lang.String input)
-
-- Decode from URL. |
-
- java.lang.String |
-encodeForBase64(byte[] input,
- boolean wrap)
-
-- Encode for Base64. |
-
- java.lang.String |
-encodeForCSS(java.lang.String input)
-
-- http://www.w3.org/TR/CSS21/syndata.html#escaped-characters |
-
- java.lang.String |
-encodeForDN(java.lang.String input)
-
-- Encode data for use in an LDAP distinguished name. |
-
- java.lang.String |
-encodeForHTML(java.lang.String input)
-
-- Encode the input string using HTML entity encoding. |
-
- java.lang.String |
-encodeForHTMLAttribute(java.lang.String input)
-
-- Encode data for use in HTML attributes. |
-
- java.lang.String |
-encodeForJavaScript(java.lang.String input)
-
-- Encode data for insertion inside a data value in JavaScript. |
-
- java.lang.String |
-encodeForLDAP(java.lang.String input)
-
-- Encode data for use in LDAP queries. |
-
- java.lang.String |
-encodeForSQL(Codec codec,
- java.lang.String input)
-
-- This method is not recommended. |
-
- java.lang.String |
-encodeForURL(java.lang.String input)
-
-- Encode for use in a URL. |
-
- java.lang.String |
-encodeForVBScript(java.lang.String input)
-
-- Encode data for insertion inside a data value in a visual basic script. |
-
- java.lang.String |
-encodeForXML(java.lang.String input)
-
-- Encode data for use in an XML element. |
-
- java.lang.String |
-encodeForXMLAttribute(java.lang.String input)
-
-- Encode data for use in an XML attribute. |
-
- java.lang.String |
-encodeForXPath(java.lang.String input)
-
-- This implementation encodes almost everything and may overencode. |
-
- java.lang.String |
-normalize(java.lang.String input)
-
-- Normalizes special characters down to ASCII using the Normalizer built - into Java. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-DefaultEncoder
--public DefaultEncoder()-
-
-
| -Method Detail | -
-canonicalize
--public java.lang.String canonicalize(java.lang.String input)-
-
-
- Simplifies encoded characters to their
- simplest form so that they can be properly validated. Attackers
- frequently use encoding schemes to disguise their attacks and bypass
- validation routines.
-
- Handling multiple encoding schemes simultaneously is difficult, and
- requires some special consideration. In particular, the problem of
- double-encoding is difficult for parsers, and combining several encoding
- schemes in double-encoding makes it even harder. Consider decoding
-
-
- < -
- - or - -- %26lt; -
- - or - -- < -
. - - This implementation disallows ALL double-encoded characters and throws an - IntrusionException when they are detected. Also, named entities that are - not known are simply removed. - - Note that most data from the browser is likely to be encoded with URL - encoding (RFC 3986). The web server will decode the URL and form data - once, so most encoded data received in the application must have been - double-encoded by the attacker. However, some HTTP inputs are not decoded - by the browser, so this routine allows a single level of decoding. --
-
-
- Specified by:
canonicalizein interfaceEncoder
-
-
- Parameters:
input- the text to canonicalize -- Returns:
- a String containing the canonicalized text -
- Throws: -
IntrusionException- See Also:
org.owasp.esapi.Validator#canonicalize(java.lang.String)
- -
-canonicalize
--public java.lang.String canonicalize(java.lang.String input, - boolean strict)-
-
-
- Strict mode throws an exception when any double encoded data is detected.
-
-
-
-
- Specified by:
canonicalizein interfaceEncoder
-
-
- Parameters:
input- the text to canonicalizestrict- true if checking for double encoding is desired, false otherwise -- Returns:
- a String containing the canonicalized text
- -
-normalize
--public java.lang.String normalize(java.lang.String input)-
-
-
- Normalizes special characters down to ASCII using the Normalizer built
- into Java. Note that this method may introduce security issues if
- characters are normalized into special characters that have meaning
- to the destination of the data.
-
-
- -
--
-
- Parameters:
input- the text to normalize -- Returns:
- a normalized String
- See Also:
org.owasp.esapi.Validator#normalize(java.lang.String)
- -
-encodeForHTML
--public java.lang.String encodeForHTML(java.lang.String input)-
-
-
- Encode the input string using HTML entity encoding. Note that the following characters:
- 00–08, 0B–0C, 0E–1F, and 7F–9F Cannot be used in HTML. See http://en.wikipedia.org/wiki/Character_encodings_in_HTML
- for more information.
- See the SGML declaration - http://www.w3.org/TR/html4/sgml/sgmldecl.html
- See the XML specification - see http://www.w3.org/TR/REC-xml/#charsets
-
-
-
-
- Specified by:
encodeForHTMLin interfaceEncoder
-
-
- Parameters:
input- the text to encode for HTML -- Returns:
- input encoded for HTML
- See Also:
Encoder.encodeForHTML(java.lang.String)
- -
-encodeForHTMLAttribute
--public java.lang.String encodeForHTMLAttribute(java.lang.String input)-
-
-
- Description copied from interface:
Encoder
- - Encode data for use in HTML attributes.
-
-
-
-
- Specified by:
encodeForHTMLAttributein interfaceEncoder
-
-
- Parameters:
input- the text to encode for an HTML attribute -- Returns:
- input encoded for use as an HTML attribute
- -
-encodeForCSS
--public java.lang.String encodeForCSS(java.lang.String input)-
-
-
- http://www.w3.org/TR/CSS21/syndata.html#escaped-characters
-
-
-
-
- Specified by:
encodeForCSSin interfaceEncoder
-
-
- Parameters:
input- the text to encode for CSS -- Returns:
- input encoded for CSS
- -
-encodeForJavaScript
--public java.lang.String encodeForJavaScript(java.lang.String input)-
-
-
- Description copied from interface:
Encoder
- - Encode data for insertion inside a data value in JavaScript. Putting user data directly
- inside a script is quite dangerous. Great care must be taken to prevent putting user data
- directly into script code itself, as no amount of encoding will prevent attacks there.
-
-
-
-
- Specified by:
encodeForJavaScriptin interfaceEncoder
-
-
- Parameters:
input- the text to encode for JavaScript -- Returns:
- input encoded for use in JavaScript
- -
-encodeForVBScript
--public java.lang.String encodeForVBScript(java.lang.String input)-
-
-
- Description copied from interface:
Encoder
- - Encode data for insertion inside a data value in a visual basic script. Putting user data directly
- inside a script is quite dangerous. Great care must be taken to prevent putting user data
- directly into script code itself, as no amount of encoding will prevent attacks there.
-
-
-
-
- Specified by:
encodeForVBScriptin interfaceEncoder
-
-
- Parameters:
input- the text to encode for VBScript -- Returns:
- input encoded for use in VBScript
- -
-encodeForSQL
--public java.lang.String encodeForSQL(Codec codec, - java.lang.String input)-
-
-
- This method is not recommended. The use PreparedStatement is the normal
- and preferred approach. However, if for some reason this is impossible,
- then this method is provided as a weaker alternative. The best approach
- is to make sure any single-quotes are double-quoted. Another possible
- approach is to use the {escape} syntax described in the JDBC
- specification in section 1.5.6 (see
- http://java.sun.com/j2se/1.4.2/docs/guide/jdbc/getstart/statement.html).
- However, this syntax does not work with all drivers, and requires
- modification of all queries.
-
-
-
-
- Specified by:
encodeForSQLin interfaceEncoder
-
-
- Parameters:
input- the inputcodec- a Codec that declares which database 'input' is being encoded for (ie. MySQL, Oracle, etc.) -- Returns:
- the string
- See Also:
org.owasp.esapi.Encoder#encodeForSQL(java.lang.String)
- -
-encodeForLDAP
--public java.lang.String encodeForLDAP(java.lang.String input)-
-
-
- Description copied from interface:
Encoder
- - Encode data for use in LDAP queries.
-
-
-
-
- Specified by:
encodeForLDAPin interfaceEncoder
-
-
- Parameters:
input- the text to encode for LDAP -- Returns:
- input encoded for use in LDAP
- -
-encodeForDN
--public java.lang.String encodeForDN(java.lang.String input)-
-
-
- Description copied from interface:
Encoder
- - Encode data for use in an LDAP distinguished name.
-
-
-
-
- Specified by:
encodeForDNin interfaceEncoder
-
-
- Parameters:
input- the text to encode for an LDAP distinguished name -- Returns:
- input encoded for use in an LDAP distinguished name
- -
-encodeForXPath
--public java.lang.String encodeForXPath(java.lang.String input)-
-
-
- This implementation encodes almost everything and may overencode. The
- difficulty is that XPath has no built in mechanism for escaping
- characters. It is possible to use XQuery in a parameterized way to
- prevent injection. For more information, refer to this
- article which specifies the following list of characters as the most
- dangerous: ^&"*';<>(). This
- paper suggests disallowing ' and " in queries.
-
-
-
-
- Specified by:
encodeForXPathin interfaceEncoder
-
-
- Parameters:
input- the input -- Returns:
- the string
- See Also:
Encoder.encodeForXPath(java.lang.String)
- -
-encodeForXML
--public java.lang.String encodeForXML(java.lang.String input)-
-
-
- Description copied from interface:
Encoder
- - Encode data for use in an XML element. The implementation should follow the XML Encoding
- Standard from the W3C.
-
- The use of a real XML parser is strongly encouraged. However, in the - hopefully rare case that you need to make sure that data is safe for - inclusion in an XML document and cannot use a parse, this method provides - a safe mechanism to do so. -
-
-
-
- Specified by:
encodeForXMLin interfaceEncoder
-
-
- Parameters:
input- the text to encode for XML -- Returns:
- input encoded for use in XML
- -
-encodeForXMLAttribute
--public java.lang.String encodeForXMLAttribute(java.lang.String input)-
-
-
- Description copied from interface:
Encoder
- - Encode data for use in an XML attribute. The implementation should follow
- the XML Encoding
- Standard from the W3C.
-
- The use of a real XML parser is highly encouraged. However, in the - hopefully rare case that you need to make sure that data is safe for - inclusion in an XML document and cannot use a parse, this method provides - a safe mechanism to do so. -
-
-
-
- Specified by:
encodeForXMLAttributein interfaceEncoder
-
-
- Parameters:
input- the text to encode for use as an XML attribute -- Returns:
- input encoded for use in an XML attribute
- -
-encodeForURL
--public java.lang.String encodeForURL(java.lang.String input) - throws EncodingException-
-
-
- Description copied from interface:
Encoder
- - Encode for use in a URL. This method performs URL encoding"
- on the entire string.
-
-
-
-
- Specified by:
encodeForURLin interfaceEncoder
-
-
- Parameters:
input- the text to encode for use in a URL -- Returns:
- input encoded for use in a URL -
- Throws: -
EncodingException- if encoding fails
- -
-decodeFromURL
--public java.lang.String decodeFromURL(java.lang.String input) - throws EncodingException-
-
-
- Description copied from interface:
Encoder
- - Decode from URL. Implementations should first canonicalize and
- detect any double-encoding. If this check passes, then the data is decoded using URL
- decoding.
-
-
-
-
- Specified by:
decodeFromURLin interfaceEncoder
-
-
- Parameters:
input- the text to decode from an encoded URL -- Returns:
- the decoded URL value -
- Throws: -
EncodingException- if decoding fails
- -
-encodeForBase64
--public java.lang.String encodeForBase64(byte[] input, - boolean wrap)-
-
-
- Description copied from interface:
Encoder
- - Encode for Base64.
-
-
-
-
- Specified by:
encodeForBase64in interfaceEncoder
-
-
- Parameters:
input- the text to encode for Base64wrap- -- Returns:
- input encoded for Base64
- -
-decodeFromBase64
--public byte[] decodeFromBase64(java.lang.String input) - throws java.io.IOException-
-
-
- Description copied from interface:
Encoder
- - Decode data encoded with BASE-64 encoding.
-
-
-
-
- Specified by:
decodeFromBase64in interfaceEncoder
-
-
- Parameters:
input- the Base64 text to decode -- Returns:
- input decoded from Base64 -
- Throws: -
java.io.IOException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/DefaultEncryptedProperties.html b/javadoc/org/owasp/esapi/reference/DefaultEncryptedProperties.html deleted file mode 100644 index 66b4b26a0..000000000 --- a/javadoc/org/owasp/esapi/reference/DefaultEncryptedProperties.html +++ /dev/null @@ -1,423 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class DefaultEncryptedProperties
--java.lang.Object --
-
-
- All Implemented Interfaces:
- EncryptedProperties -
-
-
-
- public class DefaultEncryptedProperties
- extends java.lang.Object
- implements EncryptedProperties
- extends java.lang.Object
-Reference implementation of the EncryptedProperties interface. This - implementation wraps a normal properties file, and creates surrogates for the - getProperty and setProperty methods that perform encryption and decryption based on the Encryptor. - A very simple main program is provided that can be used to create an - encrypted properties file. A better approach would be to allow unencrypted - properties in the file and to encrypt them the first time the file is - accessed. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
EncryptedProperties
- -
| -Constructor Summary | -|
DefaultEncryptedProperties()
-
-- Instantiates a new encrypted properties. |
-|
| -Method Summary | -|
- java.lang.String |
-getProperty(java.lang.String key)
-
-- Gets the property value from the encrypted store, decrypts it, and returns the plaintext value to the caller. |
-
- java.util.Set |
-keySet()
-
-- Key set. |
-
- void |
-load(java.io.InputStream in)
-
-- Load. |
-
-static void |
-main(java.lang.String[] args)
-
-- The main method. |
-
- java.lang.String |
-setProperty(java.lang.String key,
- java.lang.String value)
-
-- Encrypts the plaintext property value and stores the ciphertext value in the encrypted store. |
-
- void |
-store(java.io.OutputStream out,
- java.lang.String comments)
-
-- Store. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-DefaultEncryptedProperties
--public DefaultEncryptedProperties()-
-
-
- Instantiates a new encrypted properties.
-
-
| -Method Detail | -
-getProperty
--public java.lang.String getProperty(java.lang.String key) - throws EncryptionException-
-
-
- Description copied from interface:
EncryptedProperties
- - Gets the property value from the encrypted store, decrypts it, and returns the plaintext value to the caller.
-
-
-
-
- Specified by:
getPropertyin interfaceEncryptedProperties
-
-
- Parameters:
key- the key -- Returns:
- the decrypted property value -
- Throws: -
EncryptionException- the encryption exception
- -
-setProperty
--public java.lang.String setProperty(java.lang.String key, - java.lang.String value) - throws EncryptionException-
-
-
- Description copied from interface:
EncryptedProperties
- - Encrypts the plaintext property value and stores the ciphertext value in the encrypted store.
-
-
-
-
- Specified by:
setPropertyin interfaceEncryptedProperties
-
-
- Parameters:
key- the keyvalue- the value -- Returns:
- the encrypted property value -
- Throws: -
EncryptionException- the encryption exception
- -
-keySet
--public java.util.Set keySet()-
-
-
- Key set.
-
-
-
-
- Specified by:
keySetin interfaceEncryptedProperties
-
-
-
- Returns:
- the set
- -
-load
--public void load(java.io.InputStream in) - throws java.io.IOException-
-
-
- Load.
-
-
-
-
- Specified by:
loadin interfaceEncryptedProperties
-
-
- Parameters:
in- the in -- Throws: -
java.io.IOException- Signals that an I/O exception has occurred.
- -
-store
--public void store(java.io.OutputStream out, - java.lang.String comments) - throws java.io.IOException-
-
-
- Store.
-
-
-
-
- Specified by:
storein interfaceEncryptedProperties
-
-
- Parameters:
out- the outcomments- the comments -- Throws: -
java.io.IOException- Signals that an I/O exception has occurred.
- -
-main
--public static void main(java.lang.String[] args) - throws java.lang.Exception-
-
-
- The main method.
-
-
-
-
-
-
- Parameters:
args- the arguments -- Throws: -
java.lang.Exception- the exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/DefaultExecutor.html b/javadoc/org/owasp/esapi/reference/DefaultExecutor.html deleted file mode 100644 index 9878a8cf4..000000000 --- a/javadoc/org/owasp/esapi/reference/DefaultExecutor.html +++ /dev/null @@ -1,289 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class DefaultExecutor
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Executor -
-
-
-
- public class DefaultExecutor
- extends java.lang.Object
- implements Executor
- extends java.lang.Object
-Reference implementation of the Executor interface. This implementation is very restrictive. Commands must exactly - equal the canonical path to an executable on the system. Valid characters for parameters are alphanumeric, - forward-slash, and dash. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Executor
- -
| -Constructor Summary | -|
DefaultExecutor()
-
-- |
-|
| -Method Summary | -|
- java.lang.String |
-executeSystemCommand(java.io.File executable,
- java.util.List params,
- java.io.File workdir,
- int timeoutSeconds)
-
-- Executes a system command after checking that the executable exists and - that the parameters have not been subject to injection with untrusted - user data. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-DefaultExecutor
--public DefaultExecutor()-
-
-
| -Method Detail | -
-executeSystemCommand
--public java.lang.String executeSystemCommand(java.io.File executable, - java.util.List params, - java.io.File workdir, - int timeoutSeconds) - throws ExecutorException-
-
-
- Description copied from interface:
Executor
- - Executes a system command after checking that the executable exists and
- that the parameters have not been subject to injection with untrusted
- user data. Implementations shall change to the specified working
- directory before invoking the command. Also, processes should be
- interrupted after the specified timeout period has elapsed.
-
-
-
-
- Specified by:
executeSystemCommandin interfaceExecutor
-
-
- Parameters:
params- the parameters of the command being executedworkdir- the working directorytimeoutSeconds- the amount of time to allow this process to run -- Returns:
- the output of the command being run -
- Throws: -
ExecutorException- the service exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/DefaultHTTPUtilities.html b/javadoc/org/owasp/esapi/reference/DefaultHTTPUtilities.html deleted file mode 100644 index 7ee801069..000000000 --- a/javadoc/org/owasp/esapi/reference/DefaultHTTPUtilities.html +++ /dev/null @@ -1,1026 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class DefaultHTTPUtilities
--java.lang.Object --
-
-
- All Implemented Interfaces:
- HTTPUtilities -
-
-
-
- public class DefaultHTTPUtilities
- extends java.lang.Object
- implements HTTPUtilities
- extends java.lang.Object
-Reference implementation of the HTTPUtilities interface. This implementation - uses the Apache Commons FileUploader library, which in turn uses the Apache - Commons IO library. -
- To simplify the interface, this class uses the current request and response that - are tracked by ThreadLocal variables in the Authenticator. This means that you - must have called ESAPI.authenticator().setCurrentHTTP(request, response) before - calling these methods. -
- Typically, this is done by calling the Authenticator.login() method, which - calls setCurrentHTTP() automatically. However if you want to use these methods - in another application, you should explicitly call setCurrentHTTP() in your - own code. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
HTTPUtilities
- -
| -Field Summary | -
| Fields inherited from interface org.owasp.esapi.HTTPUtilities | -
REMEMBER_TOKEN_COOKIE_NAME |
-
| -Constructor Summary | -|
DefaultHTTPUtilities()
-
-- |
-|
| -Method Summary | -|
- java.lang.String |
-addCSRFToken(java.lang.String href)
-
-- Adds the current user's CSRF token (see User.getCSRFToken()) to the URL for purposes of preventing CSRF attacks. |
-
- void |
-assertSecureRequest(javax.servlet.http.HttpServletRequest request)
-
-- Verifies that the request is "secure" by checking that the method is a POST and - that SSL has been used. |
-
- javax.servlet.http.HttpSession |
-changeSessionIdentifier(javax.servlet.http.HttpServletRequest request)
-
-- Invalidate the old session after copying all of its contents to a newly created session with a new session id. |
-
- java.lang.String |
-decryptHiddenField(java.lang.String encrypted)
-
-- Decrypts an encrypted hidden field value and returns the cleartext. |
-
- java.util.Map |
-decryptQueryString(java.lang.String encrypted)
-
-- Takes an encrypted querystring and returns a Map containing the original parameters. |
-
- java.util.Map |
-decryptStateFromCookie(javax.servlet.http.HttpServletRequest request)
-
-- Retrieves a map of data from a cookie encrypted with encryptStateInCookie(). |
-
- java.lang.String |
-encryptHiddenField(java.lang.String value)
-
-- Encrypts a hidden field value for use in HTML. |
-
- java.lang.String |
-encryptQueryString(java.lang.String query)
-
-- Takes a querystring (i.e. |
-
- void |
-encryptStateInCookie(javax.servlet.http.HttpServletResponse response,
- java.util.Map cleartext)
-
-- Stores a Map of data in an encrypted cookie. |
-
- javax.servlet.http.Cookie |
-getCookie(javax.servlet.http.HttpServletRequest request,
- java.lang.String name)
-
-- Returns the first cookie matching the provided name. |
-
- java.lang.String |
-getCSRFToken()
-
-- Returns the current user's CSRF token. |
-
- SafeRequest |
-getCurrentRequest()
-
-- Retrieves the current HttpServletRequest |
-
- SafeResponse |
-getCurrentResponse()
-
-- Retrieves the current HttpServletResponse |
-
- java.util.List |
-getSafeFileUploads(javax.servlet.http.HttpServletRequest request,
- java.io.File tempDir,
- java.io.File finalDir)
-
-- Uses the Apache Commons FileUploader to parse the multipart HTTP request - and extract any files therein. |
-
- boolean |
-isSecureChannel(javax.servlet.http.HttpServletRequest request)
-
-- Returns true if the request was transmitted over an SSL enabled - connection. |
-
- void |
-killAllCookies(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- Kill all cookies received in the last request from the browser. |
-
- void |
-killCookie(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response,
- java.lang.String name)
-
-- Kills the specified cookie by setting a new cookie that expires immediately. |
-
- void |
-logHTTPRequest(javax.servlet.http.HttpServletRequest request,
- Logger logger)
-
-- Format the Source IP address, URL, URL parameters, and all form - parameters into a string suitable for the log file. |
-
- void |
-logHTTPRequest(javax.servlet.http.HttpServletRequest request,
- Logger logger,
- java.util.List parameterNamesToObfuscate)
-
-- Formats an HTTP request into a log suitable string. |
-
- void |
-safeSendForward(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response,
- java.lang.String context,
- java.lang.String location)
-
-- This method perform a forward to any resource located inside the WEB-INF directory. |
-
- void |
-safeSetContentType(javax.servlet.http.HttpServletResponse response)
-
-- Set the character encoding on every HttpServletResponse in order to limit - the ways in which the input data can be represented. |
-
- void |
-setCurrentHTTP(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- Stores the current HttpRequest and HttpResponse so that they may be readily accessed throughout - ESAPI (and elsewhere) |
-
- void |
-setNoCacheHeaders(javax.servlet.http.HttpServletResponse response)
-
-- Set headers to protect sensitive information against being cached in the - browser. |
-
- java.lang.String |
-setRememberToken(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response,
- java.lang.String password,
- int maxAge,
- java.lang.String domain,
- java.lang.String path)
-
-- Save the user's remember me token in a cookie. |
-
- void |
-verifyCSRFToken(javax.servlet.http.HttpServletRequest request)
-
-- Checks the CSRF token in the URL (see User.getCSRFToken()) against the user's CSRF token and - throws an IntrusionException if it is missing. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-DefaultHTTPUtilities
--public DefaultHTTPUtilities()-
-
-
| -Method Detail | -
-addCSRFToken
--public java.lang.String addCSRFToken(java.lang.String href)-
-
-
- Description copied from interface:
HTTPUtilities
- - Adds the current user's CSRF token (see User.getCSRFToken()) to the URL for purposes of preventing CSRF attacks.
- This method should be used on all URLs to be put into all links and forms the application generates.
-
-
-
-
- Specified by:
addCSRFTokenin interfaceHTTPUtilities
-
-
- Parameters:
href- the URL to which the CSRF token will be appended -- Returns:
- the updated URL with the CSRF token parameter added
- See Also:
HTTPUtilities.addCSRFToken(java.lang.String)
- -
-getCookie
--public javax.servlet.http.Cookie getCookie(javax.servlet.http.HttpServletRequest request, - java.lang.String name)-
-
-
- Returns the first cookie matching the provided name.
-
-
-
-
- Specified by:
getCookiein interfaceHTTPUtilities
-
-
- Parameters:
name- -- Returns:
- -
-getCSRFToken
--public java.lang.String getCSRFToken()-
-
-
- Description copied from interface:
HTTPUtilities
- - Returns the current user's CSRF token. If there is no current user then return null.
-
-
-
-
- Specified by:
getCSRFTokenin interfaceHTTPUtilities
-
-
-
- Returns:
- the current users CSRF token
- See Also:
HTTPUtilities.getCSRFToken()
- -
-setRememberToken
--public java.lang.String setRememberToken(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response, - java.lang.String password, - int maxAge, - java.lang.String domain, - java.lang.String path)-
-
-
- Save the user's remember me token in a cookie. Old remember me cookies should be
- destroyed first. Setting this cookie will keep the user logged in until the
- maxAge passes, the password is changed, or the cookie is deleted.
-
-
-
-
- Specified by:
setRememberTokenin interfaceHTTPUtilities
-
-
- Parameters:
password- the user's passwordmaxAge- the length of time that the token should be valid for in relative secondsdomain- the domain to restrict the token to or nullpath- the path to restrict the token to or null -- Returns:
- encrypted "Remember Me" token stored as a String
- -
-assertSecureRequest
--public void assertSecureRequest(javax.servlet.http.HttpServletRequest request) - throws AccessControlException-
-
-
- Verifies that the request is "secure" by checking that the method is a POST and
- that SSL has been used. The POST ensures that the data does not end up in bookmarks,
- web logs, referer headers, and other exposed sources. The SSL ensures that data
- has not been exposed in transit.
-
-
-
-
- Specified by:
assertSecureRequestin interfaceHTTPUtilities
-
-
-
- Throws: -
AccessControlException- if security constraints are not met
- -
-changeSessionIdentifier
--public javax.servlet.http.HttpSession changeSessionIdentifier(javax.servlet.http.HttpServletRequest request) - throws AuthenticationException-
-
-
- Description copied from interface:
HTTPUtilities
- - Invalidate the old session after copying all of its contents to a newly created session with a new session id.
- Note that this is different from logging out and creating a new session identifier that does not contain the
- existing session contents. Care should be taken to use this only when the existing session does not contain
- hazardous contents.
-
- This method uses
HTTPUtilities.getCurrentRequest()to obtain the currentHttpSessionobject --
-
-
- Specified by:
changeSessionIdentifierin interfaceHTTPUtilities
-
-
-
- Returns:
- the new HttpSession with a changed id -
- Throws: -
AuthenticationException
- -
-verifyCSRFToken
--public void verifyCSRFToken(javax.servlet.http.HttpServletRequest request) - throws IntrusionException-
-
-
- Description copied from interface:
HTTPUtilities
- - Checks the CSRF token in the URL (see User.getCSRFToken()) against the user's CSRF token and
- throws an IntrusionException if it is missing.
-
-
-
-
- Specified by:
verifyCSRFTokenin interfaceHTTPUtilities
-
-
-
- Throws: -
IntrusionException- if CSRF token is missing or incorrect
- -
-decryptHiddenField
--public java.lang.String decryptHiddenField(java.lang.String encrypted)-
-
-
- Description copied from interface:
HTTPUtilities
- - Decrypts an encrypted hidden field value and returns the cleartext. If the field does not decrypt properly,
- an IntrusionException is thrown to indicate tampering.
-
-
-
-
- Specified by:
decryptHiddenFieldin interfaceHTTPUtilities
-
-
- Parameters:
encrypted- hidden field value to decrypt -- Returns:
- decrypted hidden field value stored as a String
- -
-decryptQueryString
--public java.util.Map decryptQueryString(java.lang.String encrypted) - throws EncryptionException-
-
-
- Description copied from interface:
HTTPUtilities
- - Takes an encrypted querystring and returns a Map containing the original parameters.
-
-
-
-
- Specified by:
decryptQueryStringin interfaceHTTPUtilities
-
-
- Parameters:
encrypted- the encrypted querystring to decrypt -- Returns:
- a Map object containing the decrypted querystring -
- Throws: -
EncryptionException
- -
-decryptStateFromCookie
--public java.util.Map decryptStateFromCookie(javax.servlet.http.HttpServletRequest request) - throws EncryptionException-
-
-
- Description copied from interface:
HTTPUtilities
- - Retrieves a map of data from a cookie encrypted with encryptStateInCookie().
-
-
-
-
- Specified by:
decryptStateFromCookiein interfaceHTTPUtilities
-
-
-
- Returns:
- a map containing the decrypted cookie state value -
- Throws: -
EncryptionException- See Also:
org.owasp.esapi.HTTPUtilities#decryptStateFromCookie()
- -
-encryptHiddenField
--public java.lang.String encryptHiddenField(java.lang.String value) - throws EncryptionException-
-
-
- Description copied from interface:
HTTPUtilities
- - Encrypts a hidden field value for use in HTML.
-
-
-
-
- Specified by:
encryptHiddenFieldin interfaceHTTPUtilities
-
-
- Parameters:
value- the cleartext value of the hidden field -- Returns:
- the encrypted value of the hidden field -
- Throws: -
EncryptionException
- -
-encryptQueryString
--public java.lang.String encryptQueryString(java.lang.String query) - throws EncryptionException-
-
-
- Description copied from interface:
HTTPUtilities
- - Takes a querystring (i.e. everything after the ? in the URL) and returns an encrypted string containing the parameters.
-
-
-
-
- Specified by:
encryptQueryStringin interfaceHTTPUtilities
-
-
- Parameters:
query- the querystring to encrypt -- Returns:
- encrypted querystring stored as a String -
- Throws: -
EncryptionException
- -
-encryptStateInCookie
--public void encryptStateInCookie(javax.servlet.http.HttpServletResponse response, - java.util.Map cleartext) - throws EncryptionException-
-
-
- Description copied from interface:
HTTPUtilities
- - Stores a Map of data in an encrypted cookie. Generally the session is a better
- place to store state information, as it does not expose it to the user at all.
- If there is a requirement not to use sessions, or the data should be stored
- across sessions (for a long time), the use of encrypted cookies is an effective
- way to prevent the exposure.
-
-
-
-
- Specified by:
encryptStateInCookiein interfaceHTTPUtilities
-
-
-
- Throws: -
EncryptionException- See Also:
org.owasp.esapi.HTTPUtilities#encryptStateInCookie(java.util.Map)
- -
-getSafeFileUploads
--public java.util.List getSafeFileUploads(javax.servlet.http.HttpServletRequest request, - java.io.File tempDir, - java.io.File finalDir) - throws ValidationException-
-
-
- Uses the Apache Commons FileUploader to parse the multipart HTTP request
- and extract any files therein. Note that the progress of any uploads is
- put into a session attribute, where it can be retrieved with a simple
- JSP.
-
-
-
-
- Specified by:
getSafeFileUploadsin interfaceHTTPUtilities
-
-
- Parameters:
tempDir- the temporary directoryfinalDir- the final directory -- Returns:
- list of File objects for new files in final directory -
- Throws: -
ValidationException- if the file fails validation- See Also:
org.owasp.esapi.HTTPUtilities#safeGetFileUploads(java.io.File, java.io.File)
- -
-isSecureChannel
--public boolean isSecureChannel(javax.servlet.http.HttpServletRequest request)-
-
-
- Returns true if the request was transmitted over an SSL enabled
- connection. This implementation ignores the built-in isSecure() method
- and uses the URL to determine if the request was transmitted over SSL.
-
-
-
-
-
-
- -
-killAllCookies
--public void killAllCookies(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response)-
-
-
- Description copied from interface:
HTTPUtilities
- - Kill all cookies received in the last request from the browser. Note that new cookies set by the application in
- this response may not be killed by this method.
-
-
-
-
- Specified by:
killAllCookiesin interfaceHTTPUtilities
-
-
- -
-killCookie
--public void killCookie(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response, - java.lang.String name)-
-
-
- Description copied from interface:
HTTPUtilities
- - Kills the specified cookie by setting a new cookie that expires immediately. Note that this
- method does not delete new cookies that are being set by the application for this response.
-
-
-
-
- Specified by:
killCookiein interfaceHTTPUtilities
-
-
- -
-safeSendForward
--public void safeSendForward(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response, - java.lang.String context, - java.lang.String location) - throws AccessControlException, - javax.servlet.ServletException, - java.io.IOException-
-
-
- Description copied from interface:
HTTPUtilities
- - This method perform a forward to any resource located inside the WEB-INF directory. Forwarding to
- publicly accessible resources can be dangerous, as the request will have already passed the URL
- based access control check. This method ensures that you can only forward to non-publicly
- accessible resources.
-
-
-
-
- Specified by:
safeSendForwardin interfaceHTTPUtilities
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.location- the URL to forward to -- Throws: -
javax.servlet.ServletException-AccessControlException-java.io.IOException
- -
-safeSetContentType
--public void safeSetContentType(javax.servlet.http.HttpServletResponse response)-
-
-
- Set the character encoding on every HttpServletResponse in order to limit
- the ways in which the input data can be represented. This prevents
- malicious users from using encoding and multi-byte escape sequences to
- bypass input validation routines. The default is text/html; charset=UTF-8
- character encoding, which is the default in early versions of HTML and
- HTTP. See RFC 2047 (http://ds.internic.net/rfc/rfc2045.txt) for more
- information about character encoding and MIME.
-
-
-
-
- Specified by:
safeSetContentTypein interfaceHTTPUtilities
-
-
- See Also:
org.owasp.esapi.HTTPUtilities#safeSetContentType(java.lang.String)
- -
-setNoCacheHeaders
--public void setNoCacheHeaders(javax.servlet.http.HttpServletResponse response)-
-
-
- Set headers to protect sensitive information against being cached in the
- browser.
-
-
-
-
- Specified by:
setNoCacheHeadersin interfaceHTTPUtilities
- -
-
- -
-getCurrentRequest
--public SafeRequest getCurrentRequest()-
-
-
- Description copied from interface:
HTTPUtilities
- - Retrieves the current HttpServletRequest
-
-
-
-
- Specified by:
getCurrentRequestin interfaceHTTPUtilities
-
-
-
- Returns:
- the current request
- -
-getCurrentResponse
--public SafeResponse getCurrentResponse()-
-
-
- Description copied from interface:
HTTPUtilities
- - Retrieves the current HttpServletResponse
-
-
-
-
- Specified by:
getCurrentResponsein interfaceHTTPUtilities
-
-
-
- Returns:
- the current response
- -
-setCurrentHTTP
--public void setCurrentHTTP(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response)-
-
-
- Description copied from interface:
HTTPUtilities
- - Stores the current HttpRequest and HttpResponse so that they may be readily accessed throughout
- ESAPI (and elsewhere)
-
-
-
-
- Specified by:
setCurrentHTTPin interfaceHTTPUtilities
-
-
- Parameters:
request- the current requestresponse- the current response
- -
-logHTTPRequest
--public void logHTTPRequest(javax.servlet.http.HttpServletRequest request, - Logger logger)-
-
-
- Description copied from interface:
HTTPUtilities
- - Format the Source IP address, URL, URL parameters, and all form
- parameters into a string suitable for the log file. Be careful not
- to log sensitive information, and consider masking with the
- logHTTPRequest( List parameterNamesToObfuscate ) method.
-
-
-
-
- Specified by:
logHTTPRequestin interfaceHTTPUtilities
-
-
- Parameters:
logger- the logger to write the request to
- -
-logHTTPRequest
--public void logHTTPRequest(javax.servlet.http.HttpServletRequest request, - Logger logger, - java.util.List parameterNamesToObfuscate)-
-
-
- Formats an HTTP request into a log suitable string. This implementation logs the remote host IP address (or
- hostname if available), the request method (GET/POST), the URL, and all the querystring and form parameters. All
- the parameters are presented as though they were in the URL even if they were in a form. Any parameters that
- match items in the parameterNamesToObfuscate are shown as eight asterisks.
-
-
-
-
- Specified by:
logHTTPRequestin interfaceHTTPUtilities
-
-
- Parameters:
logger- the logger to write the request toparameterNamesToObfuscate- the sensitive parameters- See Also:
org.owasp.esapi.Logger#logHTTPRequest(org.owasp.esapi.Logger,java.util.List)
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/DefaultIntrusionDetector.html b/javadoc/org/owasp/esapi/reference/DefaultIntrusionDetector.html deleted file mode 100644 index 5e8e757a0..000000000 --- a/javadoc/org/owasp/esapi/reference/DefaultIntrusionDetector.html +++ /dev/null @@ -1,311 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class DefaultIntrusionDetector
--java.lang.Object --
-
-
- All Implemented Interfaces:
- IntrusionDetector -
-
-
-
- public class DefaultIntrusionDetector
- extends java.lang.Object
- implements IntrusionDetector
- extends java.lang.Object
-Reference implementation of the IntrusionDetector interface. This - implementation monitors EnterpriseSecurityExceptions to see if any user - exceeds a configurable threshold in a configurable time period. For example, - it can monitor to see if a user exceeds 10 input validation issues in a 1 - minute period. Or if there are more than 3 authentication problems in a 10 - second period. More complex implementations are certainly possible, such as - one that establishes a baseline of expected behavior, and then detects - deviations from that baseline. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
IntrusionDetector
- -
| -Constructor Summary | -|
DefaultIntrusionDetector()
-
-- |
-|
| -Method Summary | -|
- void |
-addEvent(java.lang.String eventName,
- java.lang.String logMessage)
-
-- Adds the event to the IntrusionDetector. |
-
- void |
-addException(java.lang.Exception e)
-
-- This implementation uses an exception store in each User object to track - exceptions. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-DefaultIntrusionDetector
--public DefaultIntrusionDetector()-
-
-
| -Method Detail | -
-addException
--public void addException(java.lang.Exception e)-
-
-
- This implementation uses an exception store in each User object to track
- exceptions.
-
-
-
-
- Specified by:
addExceptionin interfaceIntrusionDetector
-
-
- Parameters:
e- the e -- Throws: -
IntrusionException- the intrusion exception- See Also:
org.owasp.esapi.IntrusionDetector#addException(org.owasp.esapi.errors.EnterpriseSecurityException)
- -
-addEvent
--public void addEvent(java.lang.String eventName, - java.lang.String logMessage) - throws IntrusionException-
-
-
- Adds the event to the IntrusionDetector.
-
-
-
-
- Specified by:
addEventin interfaceIntrusionDetector
-
-
- Parameters:
logMessage- the message to logeventName- the event -- Throws: -
IntrusionException- the intrusion exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/DefaultRandomizer.html b/javadoc/org/owasp/esapi/reference/DefaultRandomizer.html deleted file mode 100644 index aeeb1ebb3..000000000 --- a/javadoc/org/owasp/esapi/reference/DefaultRandomizer.html +++ /dev/null @@ -1,437 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class DefaultRandomizer
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Randomizer -
-
-
-
- public class DefaultRandomizer
- extends java.lang.Object
- implements Randomizer
- extends java.lang.Object
-Reference implementation of the Randomizer interface. This implementation builds on the JCE provider to provide a - cryptographically strong source of entropy. The specific algorithm used is configurable in ESAPI.properties. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams, Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Randomizer
- -
| -Constructor Summary | -|
DefaultRandomizer()
-
-- Hide the constructor for the Singleton pattern. |
-|
| -Method Summary | -|
- boolean |
-getRandomBoolean()
-
-- Returns a random boolean. |
-
- java.lang.String |
-getRandomFilename(java.lang.String extension)
-
-- Returns an unguessable random filename with the specified extension. |
-
- java.lang.String |
-getRandomGUID()
-
-- Generates a random GUID. |
-
- int |
-getRandomInteger(int min,
- int max)
-
-- (non-Javadoc) |
-
- long |
-getRandomLong()
-
-- (non-Javadoc) |
-
- float |
-getRandomReal(float min,
- float max)
-
-- Gets the random real. |
-
- java.lang.String |
-getRandomString(int length,
- char[] characterSet)
-
-- Gets a random string. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-DefaultRandomizer
--public DefaultRandomizer()-
-
-
- Hide the constructor for the Singleton pattern.
-
-
| -Method Detail | -
-getRandomString
--public java.lang.String getRandomString(int length, - char[] characterSet)-
-
-
- Description copied from interface:
Randomizer
- - Gets a random string. of a desired length and character set.
-
-
-
-
- Specified by:
getRandomStringin interfaceRandomizer
-
-
- Parameters:
length- the length of the stringcharacterSet- the character set -- Returns:
- the random string
- -
-getRandomBoolean
--public boolean getRandomBoolean()-
-
-
- Description copied from interface:
Randomizer
- - Returns a random boolean.
-
-
-
-
- Specified by:
getRandomBooleanin interfaceRandomizer
-
-
-
- Returns:
- true or false, randomly
- -
-getRandomInteger
--public int getRandomInteger(int min, - int max)-
-
-
- (non-Javadoc)
-
-
-
-
- Specified by:
getRandomIntegerin interfaceRandomizer
-
-
- Parameters:
min- the minimum integer that will be returnedmax- the maximum integer that will be returned -- Returns:
- the random integer
- See Also:
Randomizer.getRandomInteger(int, int)
- -
-getRandomLong
--public long getRandomLong()-
-
-
- (non-Javadoc)
-
-
-
-
- Specified by:
getRandomLongin interfaceRandomizer
-
-
-
- Returns:
- the random long
- See Also:
Randomizer.getRandomLong()
- -
-getRandomReal
--public float getRandomReal(float min, - float max)-
-
-
- Description copied from interface:
Randomizer
- - Gets the random real.
-
-
-
-
- Specified by:
getRandomRealin interfaceRandomizer
-
-
- Parameters:
min- the minimum real number that will be returnedmax- the maximum real number that will be returned -- Returns:
- the random real
- -
-getRandomFilename
--public java.lang.String getRandomFilename(java.lang.String extension)-
-
-
- Returns an unguessable random filename with the specified extension.
-
-
-
-
- Specified by:
getRandomFilenamein interfaceRandomizer
-
-
-
- Returns:
- a random unguessable filename ending with the specified extension
- -
-getRandomGUID
--public java.lang.String getRandomGUID() - throws EncryptionException-
-
-
- Description copied from interface:
Randomizer
- - Generates a random GUID.
-
-
-
-
- Specified by:
getRandomGUIDin interfaceRandomizer
-
-
-
- Returns:
- the GUID -
- Throws: -
EncryptionException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/DefaultSafeFile.html b/javadoc/org/owasp/esapi/reference/DefaultSafeFile.html deleted file mode 100644 index c88cfd1de..000000000 --- a/javadoc/org/owasp/esapi/reference/DefaultSafeFile.html +++ /dev/null @@ -1,308 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class DefaultSafeFile
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.lang.Comparable, java.io.Serializable -
-
-
-
- public class DefaultSafeFile
- extends java.io.File
-Extension to java.io.File to prevent against null byte injections and - other unforeseen problems resulting from unprintable characters - causing problems in path lookups. This does _not_ prevent against - directory traversal attacks. -
- -
-
-
-
- See Also:
- Serialized Form
- -
| -Field Summary | -
| Fields inherited from class java.io.File | -
pathSeparator, pathSeparatorChar, separator, separatorChar |
-
| -Constructor Summary | -|
DefaultSafeFile(java.io.File parent,
- java.lang.String child)
-
-- |
-|
DefaultSafeFile(java.lang.String path)
-
-- |
-|
DefaultSafeFile(java.lang.String parent,
- java.lang.String child)
-
-- |
-|
DefaultSafeFile(java.net.URI uri)
-
-- |
-|
| Methods inherited from class java.io.File | -
canRead, canWrite, compareTo, compareTo, createNewFile, createTempFile, createTempFile, delete, deleteOnExit, equals, exists, getAbsoluteFile, getAbsolutePath, getCanonicalFile, getCanonicalPath, getName, getParent, getParentFile, getPath, hashCode, isAbsolute, isDirectory, isFile, isHidden, lastModified, length, list, list, listFiles, listFiles, listFiles, listRoots, mkdir, mkdirs, renameTo, setLastModified, setReadOnly, toString, toURI, toURL |
-
| Methods inherited from class java.lang.Object | -
getClass, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-DefaultSafeFile
--public DefaultSafeFile(java.lang.String path) - throws ValidationException-
-
-
- -
-DefaultSafeFile
--public DefaultSafeFile(java.lang.String parent, - java.lang.String child) - throws ValidationException-
-
-
- -
-DefaultSafeFile
--public DefaultSafeFile(java.io.File parent, - java.lang.String child) - throws ValidationException-
-
-
- -
-DefaultSafeFile
--public DefaultSafeFile(java.net.URI uri) - throws ValidationException-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/DefaultSecurityConfiguration.html b/javadoc/org/owasp/esapi/reference/DefaultSecurityConfiguration.html deleted file mode 100644 index 9af2337a6..000000000 --- a/javadoc/org/owasp/esapi/reference/DefaultSecurityConfiguration.html +++ /dev/null @@ -1,899 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class DefaultSecurityConfiguration
--java.lang.Object --
-
-
- All Implemented Interfaces:
- SecurityConfiguration -
-
-
-
- public class DefaultSecurityConfiguration
- extends java.lang.Object
- implements SecurityConfiguration
- extends java.lang.Object
-The SecurityConfiguration manages all the settings used by the ESAPI in a single place. Initializing the - Configuration is critically important to getting the ESAPI working properly. You must set a system property before - invoking any part of the ESAPI. Here is how to do it: - -
- - java -Dorg.owasp.esapi.resources="C:\temp\resources" - -- - You may have to add this to the batch script that starts your web server. For example, in the "catalina" script that - starts Tomcat, you can set the JAVA_OPTS variable to the -D string above. Once the Configuration is initialized with - a resource directory, you can edit it to set things like master keys and passwords, logging locations, error - thresholds, and allowed file extensions. -
- -
-
-
-
- Author: -
- jwilliams -
- -
| -Nested Class Summary | -
| Nested classes inherited from class org.owasp.esapi.SecurityConfiguration | -
SecurityConfiguration.Threshold |
-
| -Field Summary | -|
-static java.lang.String |
-RESOURCE_DIRECTORY
-
-- |
-
| -Constructor Summary | -|
DefaultSecurityConfiguration()
-
-- Instantiates a new configuration. |
-|
| -Method Summary | -|
- java.util.List |
-getAllowedFileExtensions()
-
-- Gets the allowed file extensions. |
-
- int |
-getAllowedFileUploadSize()
-
-- Gets the allowed file upload size. |
-
- int |
-getAllowedLoginAttempts()
-
-- Gets the allowed login attempts. |
-
- java.lang.String |
-getApplicationName()
-
-- Gets the application name, used for logging |
-
- java.lang.String |
-getCharacterEncoding()
-
-- Gets the character encoding. |
-
- java.lang.String |
-getDigitalSignatureAlgorithm()
-
-- Gets the digital signature algorithm. |
-
- java.lang.String |
-getEncryptionAlgorithm()
-
-- Gets the encryption algorithm. |
-
- java.lang.String |
-getHashAlgorithm()
-
-- Gets the hasing algorithm. |
-
- java.io.File |
-getKeystore()
-
-- Gets the keystore. |
-
- boolean |
-getLogEncodingRequired()
-
-- Returns whether HTML entity encoding should be applied to log entries. |
-
- java.util.logging.Level |
-getLogLevel()
-
-- |
-
- char[] |
-getMasterPassword()
-
-- Gets the master password. |
-
- byte[] |
-getMasterSalt()
-
-- Gets the master salt. |
-
- int |
-getMaxOldPasswordHashes()
-
-- Gets the max old password hashes. |
-
- java.lang.String |
-getPasswordParameterName()
-
-- Gets the password parameter name. |
-
- SecurityConfiguration.Threshold |
-getQuota(java.lang.String eventName)
-
-- Gets an intrusion detection Quota. |
-
- java.lang.String |
-getRandomAlgorithm()
-
-- Gets the random number generation algorithm. |
-
- long |
-getRememberTokenDuration()
-
-- Gets the time window allowed for the remember token in milliseconds. |
-
- java.lang.String |
-getResourceDirectory()
-
-- Gets the resource directory. |
-
- java.lang.String |
-getResponseContentType()
-
-- Gets the content-type set for responses. |
-
- java.lang.String |
-getUsernameParameterName()
-
-- Gets the username parameter name. |
-
- java.util.regex.Pattern |
-getValidationPattern(java.lang.String key)
-
-- |
-
- java.util.Iterator |
-getValidationPatternNames()
-
-- |
-
- void |
-setResourceDirectory(java.lang.String dir)
-
-- Sets the ESAPI resource directory. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Field Detail | -
-RESOURCE_DIRECTORY
--public static final java.lang.String RESOURCE_DIRECTORY-
-
-
- See Also:
- Constant Field Values
-
-
| -Constructor Detail | -
-DefaultSecurityConfiguration
--public DefaultSecurityConfiguration()-
-
-
- Instantiates a new configuration.
-
-
| -Method Detail | -
-getApplicationName
--public java.lang.String getApplicationName()-
-
-
- Description copied from interface:
SecurityConfiguration
- - Gets the application name, used for logging
-
-
-
-
- Specified by:
getApplicationNamein interfaceSecurityConfiguration
-
-
-
- Returns:
- the application name
- -
-getMasterPassword
--public char[] getMasterPassword()-
-
-
- Gets the master password.
-
-
-
-
- Specified by:
getMasterPasswordin interfaceSecurityConfiguration
-
-
-
- Returns:
- the master password
- -
-getKeystore
--public java.io.File getKeystore()-
-
-
- Gets the keystore.
-
-
-
-
- Specified by:
getKeystorein interfaceSecurityConfiguration
-
-
-
- Returns:
- the keystore
- -
-getResourceDirectory
--public java.lang.String getResourceDirectory()-
-
-
- Gets the resource directory.
-
-
-
-
- Specified by:
getResourceDirectoryin interfaceSecurityConfiguration
-
-
-
- Returns:
- the resource directory
- -
-setResourceDirectory
--public void setResourceDirectory(java.lang.String dir)-
-
-
- Description copied from interface:
SecurityConfiguration
- - Sets the ESAPI resource directory.
-
-
-
-
- Specified by:
setResourceDirectoryin interfaceSecurityConfiguration
-
-
- Parameters:
dir- location of the resource directory
- -
-getMasterSalt
--public byte[] getMasterSalt()-
-
-
- Gets the master salt.
-
-
-
-
- Specified by:
getMasterSaltin interfaceSecurityConfiguration
-
-
-
- Returns:
- the master salt
- -
-getAllowedFileExtensions
--public java.util.List getAllowedFileExtensions()-
-
-
- Gets the allowed file extensions.
-
-
-
-
- Specified by:
getAllowedFileExtensionsin interfaceSecurityConfiguration
-
-
-
- Returns:
- the allowed file extensions
- -
-getAllowedFileUploadSize
--public int getAllowedFileUploadSize()-
-
-
- Gets the allowed file upload size.
-
-
-
-
- Specified by:
getAllowedFileUploadSizein interfaceSecurityConfiguration
-
-
-
- Returns:
- the allowed file upload size
- -
-getPasswordParameterName
--public java.lang.String getPasswordParameterName()-
-
-
- Gets the password parameter name.
-
-
-
-
- Specified by:
getPasswordParameterNamein interfaceSecurityConfiguration
-
-
-
- Returns:
- the password parameter name
- -
-getUsernameParameterName
--public java.lang.String getUsernameParameterName()-
-
-
- Gets the username parameter name.
-
-
-
-
- Specified by:
getUsernameParameterNamein interfaceSecurityConfiguration
-
-
-
- Returns:
- the username parameter name
- -
-getEncryptionAlgorithm
--public java.lang.String getEncryptionAlgorithm()-
-
-
- Gets the encryption algorithm.
-
-
-
-
- Specified by:
getEncryptionAlgorithmin interfaceSecurityConfiguration
-
-
-
- Returns:
- the algorithm
- -
-getHashAlgorithm
--public java.lang.String getHashAlgorithm()-
-
-
- Gets the hasing algorithm.
-
-
-
-
- Specified by:
getHashAlgorithmin interfaceSecurityConfiguration
-
-
-
- Returns:
- the algorithm
- -
-getCharacterEncoding
--public java.lang.String getCharacterEncoding()-
-
-
- Gets the character encoding.
-
-
-
-
- Specified by:
getCharacterEncodingin interfaceSecurityConfiguration
-
-
-
- Returns:
- encoding name
- -
-getDigitalSignatureAlgorithm
--public java.lang.String getDigitalSignatureAlgorithm()-
-
-
- Gets the digital signature algorithm.
-
-
-
-
- Specified by:
getDigitalSignatureAlgorithmin interfaceSecurityConfiguration
-
-
-
- Returns:
- encoding name
- -
-getRandomAlgorithm
--public java.lang.String getRandomAlgorithm()-
-
-
- Gets the random number generation algorithm.
-
-
-
-
- Specified by:
getRandomAlgorithmin interfaceSecurityConfiguration
-
-
-
- Returns:
- encoding name
- -
-getAllowedLoginAttempts
--public int getAllowedLoginAttempts()-
-
-
- Gets the allowed login attempts.
-
-
-
-
- Specified by:
getAllowedLoginAttemptsin interfaceSecurityConfiguration
-
-
-
- Returns:
- the allowed login attempts
- -
-getMaxOldPasswordHashes
--public int getMaxOldPasswordHashes()-
-
-
- Gets the max old password hashes.
-
-
-
-
- Specified by:
getMaxOldPasswordHashesin interfaceSecurityConfiguration
-
-
-
- Returns:
- the max old password hashes
- -
-getQuota
--public SecurityConfiguration.Threshold getQuota(java.lang.String eventName)-
-
-
- Description copied from interface:
SecurityConfiguration
- - Gets an intrusion detection Quota.
-
-
-
-
- Specified by:
getQuotain interfaceSecurityConfiguration
-
-
- Parameters:
eventName- the event whose quota is desired -- Returns:
- the matching Quota for eventName
- -
-getLogLevel
--public java.util.logging.Level getLogLevel()-
-
-
-
-
--
-
-
- -
-getResponseContentType
--public java.lang.String getResponseContentType()-
-
-
- Description copied from interface:
SecurityConfiguration
- - Gets the content-type set for responses.
-
-
-
-
- Specified by:
getResponseContentTypein interfaceSecurityConfiguration
-
-
- -
-getRememberTokenDuration
--public long getRememberTokenDuration()-
-
-
- Description copied from interface:
SecurityConfiguration
- - Gets the time window allowed for the remember token in milliseconds.
-
-
-
-
- Specified by:
getRememberTokenDurationin interfaceSecurityConfiguration
-
-
- -
-getValidationPatternNames
--public java.util.Iterator getValidationPatternNames()-
-
-
-
-
--
-
-
- -
-getValidationPattern
--public java.util.regex.Pattern getValidationPattern(java.lang.String key)-
-
-
-
-
--
-
-
- -
-getLogEncodingRequired
--public boolean getLogEncodingRequired()-
-
-
- Description copied from interface:
SecurityConfiguration
- - Returns whether HTML entity encoding should be applied to log entries.
-
-
-
-
- Specified by:
getLogEncodingRequiredin interfaceSecurityConfiguration
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/DefaultUser.html b/javadoc/org/owasp/esapi/reference/DefaultUser.html deleted file mode 100644 index 04812445e..000000000 --- a/javadoc/org/owasp/esapi/reference/DefaultUser.html +++ /dev/null @@ -1,1352 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class DefaultUser
--java.lang.Object --
-
-
- All Implemented Interfaces:
- java.security.Principal, java.io.Serializable, User -
-
-
-
- public class DefaultUser
- extends java.lang.Object
- implements User, java.io.Serializable
- extends java.lang.Object
-Reference implementation of the User interface. This implementation is serialized into a flat file in a simple format. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
User, -Serialized Form
- -
| -Field Summary | -
| Fields inherited from interface org.owasp.esapi.User | -
ANONYMOUS |
-
| -Method Summary | -|
- void |
-addRole(java.lang.String role)
-
-- Adds a role to an account. |
-
- void |
-addRoles(java.util.Set newRoles)
-
-- Adds a set of roles to an account. |
-
- void |
-changePassword(java.lang.String oldPassword,
- java.lang.String newPassword1,
- java.lang.String newPassword2)
-
-- Sets the user's password, performing a verification of the user's old password, the equality of the two new - passwords, and the strength of the new password. |
-
- java.lang.Object |
-clone()
-
-- Override clone and make final to prevent duplicate user objects. |
-
- void |
-disable()
-
-- Disable account. |
-
- void |
-enable()
-
-- Enable the account |
-
- long |
-getAccountId()
-
-- Gets the account id. |
-
- java.lang.String |
-getAccountName()
-
-- Gets the account name. |
-
- java.lang.String |
-getCSRFToken()
-
-- Gets the CSRF token. |
-
- java.util.Date |
-getExpirationTime()
-
-- Gets the expiration time. |
-
- int |
-getFailedLoginCount()
-
-- Gets the failed login count. |
-
- java.util.Date |
-getLastFailedLoginTime()
-
-- Gets the last failed login time. |
-
- java.lang.String |
-getLastHostAddress()
-
-- Returns the last host address used by the user. |
-
- java.util.Date |
-getLastLoginTime()
-
-- Gets the last login time. |
-
- java.util.Date |
-getLastPasswordChangeTime()
-
-- Gets the last password change time. |
-
- java.lang.String |
-getName()
-
-- |
-
- java.util.Set |
-getRoles()
-
-- Gets the roles. |
-
- java.lang.String |
-getScreenName()
-
-- Gets the screen name. |
-
- void |
-incrementFailedLoginCount()
-
-- Increment failed login count. |
-
- boolean |
-isAnonymous()
-
-- Checks if user is anonymous. |
-
- boolean |
-isEnabled()
-
-- Checks if is enabled. |
-
- boolean |
-isExpired()
-
-- Checks if an account is expired. |
-
- boolean |
-isInRole(java.lang.String role)
-
-- Checks if an account has been assigned a particular role. |
-
- boolean |
-isLocked()
-
-- Checks if an account is locked. |
-
- boolean |
-isLoggedIn()
-
-- Tests to see if the user is currently logged in. |
-
- boolean |
-isSessionAbsoluteTimeout()
-
-- Tests to see if the user's session has exceeded the absolute time out. |
-
- boolean |
-isSessionTimeout()
-
-- Tests to see if the user's session has timed out from inactivity. |
-
- void |
-lock()
-
-- Lock the user's account. |
-
- void |
-loginWithPassword(java.lang.String password)
-
-- Login with password. |
-
- void |
-logout()
-
-- Logout this user. |
-
- void |
-removeRole(java.lang.String role)
-
-- Removes a role from an account. |
-
- java.lang.String |
-resetCSRFToken()
-
-- In this implementation, we have chosen to use a random token that is - stored in the User object. |
-
- void |
-setAccountName(java.lang.String accountName)
-
-- Sets the account name. |
-
- void |
-setExpirationTime(java.util.Date expirationTime)
-
-- Sets the expiration time. |
-
- void |
-setLastFailedLoginTime(java.util.Date lastFailedLoginTime)
-
-- Sets the last failed login time. |
-
- void |
-setLastHostAddress(java.lang.String remoteHost)
-
-- Sets the last remote host address used by this User. |
-
- void |
-setLastLoginTime(java.util.Date lastLoginTime)
-
-- Sets the last login time. |
-
- void |
-setLastPasswordChangeTime(java.util.Date lastPasswordChangeTime)
-
-- Sets the last password change time. |
-
- void |
-setRoles(java.util.Set roles)
-
-- Sets the roles. |
-
- void |
-setScreenName(java.lang.String screenName)
-
-- Sets the screen name. |
-
- java.lang.String |
-toString()
-
-- |
-
- void |
-unlock()
-
-- Unlock account. |
-
- boolean |
-verifyPassword(java.lang.String password)
-
-- Verify that the supplied password matches the password for this user. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| Methods inherited from interface java.security.Principal | -
equals, hashCode |
-
| -Method Detail | -
-addRole
--public void addRole(java.lang.String role) - throws AuthenticationException-
-
-
- Description copied from interface:
User
- - Adds a role to an account.
-
-
- -
--
-
- Parameters:
role- the role to add -- Throws: -
AuthenticationException- the authentication exception
- -
-addRoles
--public void addRoles(java.util.Set newRoles) - throws AuthenticationException-
-
-
- Description copied from interface:
User
- - Adds a set of roles to an account.
-
-
- -
--
-
- Parameters:
newRoles- the new roles to add -- Throws: -
AuthenticationException- the authentication exception
- -
-changePassword
--public void changePassword(java.lang.String oldPassword, - java.lang.String newPassword1, - java.lang.String newPassword2) - throws AuthenticationException, - EncryptionException-
-
-
- Description copied from interface:
User
- - Sets the user's password, performing a verification of the user's old password, the equality of the two new
- passwords, and the strength of the new password.
-
-
-
-
- Specified by:
changePasswordin interfaceUser
-
-
- Parameters:
oldPassword- the old passwordnewPassword1- the new passwordnewPassword2- the new password - used to verify that the new password was typed correctly -- Throws: -
EncryptionException-AuthenticationException- if newPassword1 does not match newPassword2, if oldPassword does not match the stored old password, or if the new password does not meet complexity requirements
- -
-disable
--public void disable()-
-
-
- Description copied from interface:
User
- - Disable account.
-
-
- -
--
-
- -
-enable
--public void enable()-
-
-
- Enable the account
-
-
- -
--
-
- See Also:
User.enable()
- -
-getAccountId
--public long getAccountId()-
-
-
- Description copied from interface:
User
- - Gets the account id.
-
-
-
-
- Specified by:
getAccountIdin interfaceUser
-
-
-
- Returns:
- the account id
- -
-getAccountName
--public java.lang.String getAccountName()-
-
-
- Gets the account name.
-
-
-
-
- Specified by:
getAccountNamein interfaceUser
-
-
-
- Returns:
- the accountName
- -
-getCSRFToken
--public java.lang.String getCSRFToken()-
-
-
- Gets the CSRF token. Use the HTTPUtilities.checkCSRFToken( request ) to verify the token.
-
-
-
-
- Specified by:
getCSRFTokenin interfaceUser
-
-
-
- Returns:
- the csrfToken
- -
-getExpirationTime
--public java.util.Date getExpirationTime()-
-
-
- Gets the expiration time.
-
-
-
-
- Specified by:
getExpirationTimein interfaceUser
-
-
-
- Returns:
- The expiration time of the current user.
- -
-getFailedLoginCount
--public int getFailedLoginCount()-
-
-
- Gets the failed login count.
-
-
-
-
- Specified by:
getFailedLoginCountin interfaceUser
-
-
-
- Returns:
- the failedLoginCount
- -
-getLastFailedLoginTime
--public java.util.Date getLastFailedLoginTime()-
-
-
- Gets the last failed login time.
-
-
-
-
- Specified by:
getLastFailedLoginTimein interfaceUser
-
-
-
- Returns:
- the lastFailedLoginTime
- -
-getLastHostAddress
--public java.lang.String getLastHostAddress()-
-
-
- Description copied from interface:
User
- - Returns the last host address used by the user. This will be used in any log messages generated by the processing
- of this request.
-
-
-
-
- Specified by:
getLastHostAddressin interfaceUser
-
-
-
- Returns:
- the last host address used by the user
- -
-getLastLoginTime
--public java.util.Date getLastLoginTime()-
-
-
- Gets the last login time.
-
-
-
-
- Specified by:
getLastLoginTimein interfaceUser
-
-
-
- Returns:
- the lastLoginTime
- -
-getLastPasswordChangeTime
--public java.util.Date getLastPasswordChangeTime()-
-
-
- Gets the last password change time.
-
-
-
-
- Specified by:
getLastPasswordChangeTimein interfaceUser
-
-
-
- Returns:
- the lastPasswordChangeTime
- -
-getName
--public java.lang.String getName()-
-
-
-
-
- Specified by:
getNamein interfacejava.security.Principal
--
-
-
- -
-getRoles
--public java.util.Set getRoles()- -
- -
-getScreenName
--public java.lang.String getScreenName()-
-
-
- Description copied from interface:
User
- - Gets the screen name.
-
-
-
-
- Specified by:
getScreenNamein interfaceUser
-
-
-
- Returns:
- the screen name
- -
-incrementFailedLoginCount
--public void incrementFailedLoginCount()-
-
-
- Description copied from interface:
User
- - Increment failed login count.
-
-
-
-
- Specified by:
incrementFailedLoginCountin interfaceUser
-
-
- -
-isAnonymous
--public boolean isAnonymous()-
-
-
- Description copied from interface:
User
- - Checks if user is anonymous.
-
-
-
-
- Specified by:
isAnonymousin interfaceUser
-
-
-
- Returns:
- true, if user is anonymous
- -
-isEnabled
--public boolean isEnabled()- -
- -
-isExpired
--public boolean isExpired()-
-
-
- Description copied from interface:
User
- - Checks if an account is expired.
-
-
- -
--
-
-
- Returns:
- true, if account is expired
- -
-isInRole
--public boolean isInRole(java.lang.String role)-
-
-
- Description copied from interface:
User
- - Checks if an account has been assigned a particular role.
-
-
- -
--
-
- Parameters:
role- the role for which to check -- Returns:
- true, if role has been assigned to user
- -
-isLocked
--public boolean isLocked()-
-
-
- Description copied from interface:
User
- - Checks if an account is locked.
-
-
- -
--
-
-
- Returns:
- true, if account is locked
- -
-isLoggedIn
--public boolean isLoggedIn()-
-
-
- Description copied from interface:
User
- - Tests to see if the user is currently logged in.
-
-
-
-
- Specified by:
isLoggedInin interfaceUser
-
-
-
- Returns:
- true, if the user is logged in
- -
-isSessionAbsoluteTimeout
--public boolean isSessionAbsoluteTimeout()-
-
-
- Description copied from interface:
User
- - Tests to see if the user's session has exceeded the absolute time out.
-
-
-
-
- Specified by:
isSessionAbsoluteTimeoutin interfaceUser
-
-
-
- Returns:
- true, if user's session has exceeded the absolute time out
- -
-isSessionTimeout
--public boolean isSessionTimeout()-
-
-
- Description copied from interface:
User
- - Tests to see if the user's session has timed out from inactivity.
-
-
-
-
- Specified by:
isSessionTimeoutin interfaceUser
-
-
-
- Returns:
- true, if user's session has timed out from inactivity
- -
-lock
--public void lock()-
-
-
- Description copied from interface:
User
- - Lock the user's account.
-
-
- -
--
-
- -
-loginWithPassword
--public void loginWithPassword(java.lang.String password) - throws AuthenticationException-
-
-
- Description copied from interface:
User
- - Login with password.
-
-
-
-
- Specified by:
loginWithPasswordin interfaceUser
-
-
- Parameters:
password- the password -- Throws: -
AuthenticationException- if login fails
- -
-logout
--public void logout()-
-
-
- Description copied from interface:
User
- - Logout this user.
-
-
- -
--
-
- -
-removeRole
--public void removeRole(java.lang.String role)-
-
-
- Description copied from interface:
User
- - Removes a role from an account.
-
-
-
-
- Specified by:
removeRolein interfaceUser
-
-
- Parameters:
role- the role to remove
- -
-resetCSRFToken
--public java.lang.String resetCSRFToken()-
-
-
- In this implementation, we have chosen to use a random token that is
- stored in the User object. Note that it is possible to avoid the use of
- server side state by using either the hash of the users's session id or
- an encrypted token that includes a timestamp and the user's IP address.
- user's IP address. A relatively short 8 character string has been chosen
- because this token will appear in all links and forms.
-
-
-
-
- Specified by:
resetCSRFTokenin interfaceUser
-
-
-
- Returns:
- the string
- See Also:
User.resetCSRFToken()
- -
-setAccountName
--public void setAccountName(java.lang.String accountName)-
-
-
- Sets the account name.
-
-
-
-
- Specified by:
setAccountNamein interfaceUser
-
-
- Parameters:
accountName- the accountName to set
- -
-setExpirationTime
--public void setExpirationTime(java.util.Date expirationTime)-
-
-
- Sets the expiration time.
-
-
-
-
- Specified by:
setExpirationTimein interfaceUser
-
-
- Parameters:
expirationTime- the expirationTime to set
- -
-setLastFailedLoginTime
--public void setLastFailedLoginTime(java.util.Date lastFailedLoginTime)-
-
-
- Sets the last failed login time.
-
-
-
-
- Specified by:
setLastFailedLoginTimein interfaceUser
-
-
- Parameters:
lastFailedLoginTime- the lastFailedLoginTime to set
- -
-setLastHostAddress
--public void setLastHostAddress(java.lang.String remoteHost)-
-
-
- Sets the last remote host address used by this User.
-
-
-
-
- Specified by:
setLastHostAddressin interfaceUser
-
-
- Parameters:
remoteHost-
- -
-setLastLoginTime
--public void setLastLoginTime(java.util.Date lastLoginTime)-
-
-
- Sets the last login time.
-
-
-
-
- Specified by:
setLastLoginTimein interfaceUser
-
-
- Parameters:
lastLoginTime- the lastLoginTime to set
- -
-setLastPasswordChangeTime
--public void setLastPasswordChangeTime(java.util.Date lastPasswordChangeTime)-
-
-
- Sets the last password change time.
-
-
-
-
- Specified by:
setLastPasswordChangeTimein interfaceUser
-
-
- Parameters:
lastPasswordChangeTime- the lastPasswordChangeTime to set
- -
-setRoles
--public void setRoles(java.util.Set roles) - throws AuthenticationException-
-
-
- Sets the roles.
-
-
- -
--
-
- Parameters:
roles- the roles to set -- Throws: -
AuthenticationException- the authentication exception
- -
-setScreenName
--public void setScreenName(java.lang.String screenName)-
-
-
- Description copied from interface:
User
- - Sets the screen name.
-
-
-
-
- Specified by:
setScreenNamein interfaceUser
-
-
- Parameters:
screenName- the new screen name
- -
-toString
--public java.lang.String toString()-
-
-
-
-
- Specified by:
toStringin interfacejava.security.Principal
--
-
-
- -
-unlock
--public void unlock()-
-
-
- Description copied from interface:
User
- - Unlock account.
-
-
- -
--
-
- -
-verifyPassword
--public boolean verifyPassword(java.lang.String password)-
-
-
- Description copied from interface:
User
- - Verify that the supplied password matches the password for this user. This method
- is typically used for "reauthentication" for the most sensitive functions, such
- as transactions, changing email address, and changing other account information.
-
-
-
-
- Specified by:
verifyPasswordin interfaceUser
-
-
- Parameters:
password- the password that the user entered -- Returns:
- true, if the password passed in matches the account's password
- -
-clone
--public final java.lang.Object clone() - throws java.lang.CloneNotSupportedException-
-
-
- Override clone and make final to prevent duplicate user objects.
-
-
-
-
-
-
-
- Throws: -
java.lang.CloneNotSupportedException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/DefaultValidator.html b/javadoc/org/owasp/esapi/reference/DefaultValidator.html deleted file mode 100644 index f3c0a33e0..000000000 --- a/javadoc/org/owasp/esapi/reference/DefaultValidator.html +++ /dev/null @@ -1,2130 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class DefaultValidator
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Validator -
-
-
-
- public class DefaultValidator
- extends java.lang.Object
- implements Validator
- extends java.lang.Object
-Reference implementation of the Validator interface. This implementation - relies on the ESAPI Encoder, Java Pattern (regex), Date, - and several other classes to provide basic validation functions. This library - has a heavy emphasis on whitelist validation and canonicalization. All double-encoded - characters, even in multiple encoding schemes, such as
<or -
%26lt;or even%25%26lt;are disallowed. -- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security, Jim Manico (jim.manico .at. aspectsecurity.com) Aspect Security -
- See Also:
Validator
- -
| -Constructor Summary | -|
DefaultValidator()
-
-- |
-|
| -Method Summary | -|
- void |
-assertIsValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- void |
-assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional)
-
-- Validates that the parameters in the current request contain all required parameters and only optional ones in - addition. |
-
- void |
-assertIsValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set required,
- java.util.Set optional,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of assertIsValidHTTPRequestParameterSet |
-
- void |
-assertValidFileUpload(java.lang.String context,
- java.lang.String directorypath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Validates the filepath, filename, and content of a file. |
-
- void |
-assertValidFileUpload(java.lang.String context,
- java.lang.String filepath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of assertValidFileUpload |
-
- java.lang.String |
-getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated credit card number as a String. |
-
- java.lang.String |
-getValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidCreditCard |
-
- java.util.Date |
-getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns a valid date as a Date. |
-
- java.util.Date |
-getValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull,
- ValidationErrorList errors)
-
-- Returns a valid date as a Date. |
-
- java.lang.String |
-getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated directory path as a String. |
-
- java.lang.String |
-getValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidDirectoryPath |
-
- java.lang.Double |
-getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- java.lang.Double |
-getValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull,
- ValidationErrorList errors)
-
-- Returns a validated real number as a double. |
-
- byte[] |
-getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns validated file content as a byte array. |
-
- byte[] |
-getValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull,
- ValidationErrorList errors)
-
-- Returns validated file content as a byte array. |
-
- java.lang.String |
-getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated file name as a String. |
-
- java.lang.String |
-getValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errors)
-
-- Returns a canonicalized and validated file name as a String. |
-
- java.lang.String |
-getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Validates data received from the browser and returns a safe version. |
-
- java.lang.String |
-getValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errors)
-
-- Validates data received from the browser and returns a safe version. |
-
- java.lang.Integer |
-getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- java.lang.Integer |
-getValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull,
- ValidationErrorList errors)
-
-- Returns a validated integer. |
-
- java.lang.String |
-getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns the list item that exactly matches the canonicalized input. |
-
- java.lang.String |
-getValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidListItem |
-
- java.lang.Double |
-getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns a validated number as a double. |
-
- java.lang.Double |
-getValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull,
- ValidationErrorList errors)
-
-- Returns a validated number as a double within the range of minValue to maxValue. |
-
- byte[] |
-getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a byte array. |
-
- byte[] |
-getValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidPrintable |
-
- java.lang.String |
-getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated printable characters as a String. |
-
- java.lang.String |
-getValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidPrintable |
-
- java.lang.String |
-getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns a canonicalized and validated redirect location as a String. |
-
- java.lang.String |
-getValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidRedirectLocation |
-
- java.lang.String |
-getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns canonicalized and validated "safe" HTML. |
-
- java.lang.String |
-getValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull,
- ValidationErrorList errors)
-
-- ValidationErrorList variant of getValidSafeHTML |
-
- boolean |
-isValidCreditCard(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid credit card. |
-
- boolean |
-isValidDate(java.lang.String context,
- java.lang.String input,
- java.text.DateFormat format,
- boolean allowNull)
-
-- Returns true if input is a valid date according to the specified date format. |
-
- boolean |
-isValidDirectoryPath(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if the directory path (not including a filename) is valid. |
-
- boolean |
-isValidDouble(java.lang.String context,
- java.lang.String input,
- double minValue,
- double maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid double within the range of minValue to maxValue. |
-
- boolean |
-isValidFileContent(java.lang.String context,
- byte[] input,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if input is valid file content. |
-
- boolean |
-isValidFileName(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid file name. |
-
- boolean |
-isValidFileUpload(java.lang.String context,
- java.lang.String directorypath,
- java.lang.String filename,
- byte[] content,
- int maxBytes,
- boolean allowNull)
-
-- Returns true if a file upload has a valid name, path, and content. |
-
- boolean |
-isValidHTTPRequest()
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- boolean |
-isValidHTTPRequest(javax.servlet.http.HttpServletRequest request)
-
-- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed - characters. |
-
- boolean |
-isValidHTTPRequestParameterSet(java.lang.String context,
- java.util.Set requiredNames,
- java.util.Set optionalNames)
-
-- Returns true if the parameters in the current request contain all required parameters and only optional ones in addition. |
-
- boolean |
-isValidInput(java.lang.String context,
- java.lang.String input,
- java.lang.String type,
- int maxLength,
- boolean allowNull)
-
-- Returns true if data received from browser is valid. |
-
- boolean |
-isValidInteger(java.lang.String context,
- java.lang.String input,
- int minValue,
- int maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid integer within the range of minValue to maxValue. |
-
- boolean |
-isValidListItem(java.lang.String context,
- java.lang.String input,
- java.util.List list)
-
-- Returns true if input is a valid list item. |
-
- boolean |
-isValidNumber(java.lang.String context,
- java.lang.String input,
- long minValue,
- long maxValue,
- boolean allowNull)
-
-- Returns true if input is a valid number within the range of minValue to maxValue. |
-
- boolean |
-isValidPrintable(java.lang.String context,
- byte[] input,
- int maxLength,
- boolean allowNull)
-
-- Checks that all bytes are valid ASCII characters (between 33 and 126 - inclusive). |
-
- boolean |
-isValidPrintable(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input contains only valid printable ASCII characters (32-126). |
-
- boolean |
-isValidRedirectLocation(java.lang.String context,
- java.lang.String input,
- boolean allowNull)
-
-- Returns true if input is a valid redirect location. |
-
- boolean |
-isValidSafeHTML(java.lang.String context,
- java.lang.String input,
- int maxLength,
- boolean allowNull)
-
-- Returns true if input is "safe" HTML. |
-
- java.lang.String |
-safeReadLine(java.io.InputStream in,
- int max)
-
-- This implementation reads until a newline or the specified number of - characters. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-DefaultValidator
--public DefaultValidator()-
-
-
| -Method Detail | -
-isValidInput
--public boolean isValidInput(java.lang.String context, - java.lang.String input, - java.lang.String type, - int maxLength, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if data received from browser is valid. Only URL encoding is
- supported. Double encoding is treated as an attack.
-
-
-
-
- Specified by:
isValidInputin interfaceValidator
-
-
- Parameters:
context- A descriptive name for the field to validate. This is used for error facing validation messages and element identification.input- The actual user input data to validate.type- The regular expression name while maps to the actual regular expression from "ESAPI.properties".maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then a input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- The canonicalized user input. -
- Throws: -
IntrusionException
- -
-getValidInput
--public java.lang.String getValidInput(java.lang.String context, - java.lang.String input, - java.lang.String type, - int maxLength, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Validates data received from the browser and returns a safe version. Only
- URL encoding is supported. Double encoding is treated as an attack.
-
-
-
-
- Specified by:
getValidInputin interfaceValidator
-
-
- Parameters:
context- A descriptive name for the field to validate. This is used for error facing validation messages and element identification.input- The actual user input data to validate.type- The regular expression name while maps to the actual regular expression from "ESAPI.properties".maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then a input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- The canonicalized user input. -
- Throws: -
ValidationException-IntrusionException
- -
-getValidInput
--public java.lang.String getValidInput(java.lang.String context, - java.lang.String input, - java.lang.String type, - int maxLength, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- Validates data received from the browser and returns a safe version. Only
- URL encoding is supported. Double encoding is treated as an attack.
-
-
-
-
- Specified by:
getValidInputin interfaceValidator
-
-
- Parameters:
context- A descriptive name for the field to validate. This is used for error facing validation messages and element identification.input- The actual user input data to validate.type- The regular expression name while maps to the actual regular expression from "ESAPI.properties".maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then a input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If ValidationException is thrown, then add to error list instead of throwing out to caller -- Returns:
- The canonicalized user input. -
- Throws: -
IntrusionException
- -
-isValidDate
--public boolean isValidDate(java.lang.String context, - java.lang.String input, - java.text.DateFormat format, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid date according to the specified date format.
-
-
-
-
- Specified by:
isValidDatein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.format- Required formatting of date inputted.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid date according to the format specified by 'format' -
- Throws: -
IntrusionException
- -
-getValidDate
--public java.util.Date getValidDate(java.lang.String context, - java.lang.String input, - java.text.DateFormat format, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Description copied from interface:
Validator
- - Returns a valid date as a Date. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
getValidDatein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.format- Required formatting of date inputted.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- A valid date as a Date -
- Throws: -
IntrusionException-ValidationException
- -
-getValidDate
--public java.util.Date getValidDate(java.lang.String context, - java.lang.String input, - java.text.DateFormat format, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- Description copied from interface:
Validator
- - Returns a valid date as a Date. Invalid input will generate a descriptive ValidationException and store it inside of
- the errorList argument, and input that is clearly an attack will generate a descriptive IntrusionException. Instead of
- throwing a ValidationException on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Specified by:
getValidDatein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.format- Required formatting of date inputted.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A valid date as a Date -
- Throws: -
IntrusionException
- -
-isValidSafeHTML
--public boolean isValidSafeHTML(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull) - throws IntrusionException-
-
-
- Description copied from interface:
Validator
- - Returns true if input is "safe" HTML. Implementors should reference the OWASP AntiSamy project for ideas
- on how to do HTML validation in a whitelist way, as this is an extremely difficult problem.
-
-
-
-
- Specified by:
isValidSafeHTMLin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is valid safe HTML -
- Throws: -
IntrusionException
- -
-getValidSafeHTML
--public java.lang.String getValidSafeHTML(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Description copied from interface:
Validator
- - Returns canonicalized and validated "safe" HTML. Implementors should reference the OWASP AntiSamy project for ideas
- on how to do HTML validation in a whitelist way, as this is an extremely difficult problem.
-
-
-
-
- Specified by:
getValidSafeHTMLin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- Valid safe HTML -
- Throws: -
IntrusionException-ValidationException
- -
-getValidSafeHTML
--public java.lang.String getValidSafeHTML(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- ValidationErrorList variant of getValidSafeHTML
-
-
-
-
- Specified by:
getValidSafeHTMLin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.maxLength- The maximum post-canonicalized String length allowed.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- Valid safe HTML -
- Throws: -
IntrusionException
- -
-isValidCreditCard
--public boolean isValidCreditCard(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws IntrusionException-
-
-
- Description copied from interface:
Validator
- - Returns true if input is a valid credit card. Maxlength is mandated by valid credit card type.
-
-
-
-
- Specified by:
isValidCreditCardin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid credit card number -
- Throws: -
IntrusionException
- -
-getValidCreditCard
--public java.lang.String getValidCreditCard(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a canonicalized and validated credit card number as a String. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
getValidCreditCardin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual user input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- A valid credit card number -
- Throws: -
ValidationException-IntrusionException
- -
-getValidCreditCard
--public java.lang.String getValidCreditCard(java.lang.String context, - java.lang.String input, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- ValidationErrorList variant of getValidCreditCard
-
-
-
-
- Specified by:
getValidCreditCardin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A valid credit card number -
- Throws: -
IntrusionException
- -
-isValidDirectoryPath
--public boolean isValidDirectoryPath(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if the directory path (not including a filename) is valid.
-
-
-
-
- Specified by:
isValidDirectoryPathin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid directory path -
- Throws: -
IntrusionException- See Also:
org.owasp.esapi.Validator#isValidDirectoryPath(java.lang.String)
- -
-getValidDirectoryPath
--public java.lang.String getValidDirectoryPath(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a canonicalized and validated directory path as a String. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
getValidDirectoryPathin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- A valid directory path -
- Throws: -
IntrusionException-ValidationException
- -
-getValidDirectoryPath
--public java.lang.String getValidDirectoryPath(java.lang.String context, - java.lang.String input, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- ValidationErrorList variant of getValidDirectoryPath
-
-
-
-
- Specified by:
getValidDirectoryPathin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A valid directory path -
- Throws: -
IntrusionException
- -
-isValidFileName
--public boolean isValidFileName(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid file name.
-
-
-
-
- Specified by:
isValidFileNamein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid file name -
- Throws: -
IntrusionException
- -
-getValidFileName
--public java.lang.String getValidFileName(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a canonicalized and validated file name as a String. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
getValidFileNamein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- A valid file name -
- Throws: -
ValidationException-IntrusionException
- -
-getValidFileName
--public java.lang.String getValidFileName(java.lang.String context, - java.lang.String input, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- Returns a canonicalized and validated file name as a String. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
getValidFileNamein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A valid file name -
- Throws: -
IntrusionException
- -
-isValidNumber
--public boolean isValidNumber(java.lang.String context, - java.lang.String input, - long minValue, - long maxValue, - boolean allowNull) - throws IntrusionException-
-
-
- Description copied from interface:
Validator
- - Returns true if input is a valid number within the range of minValue to maxValue.
-
-
-
-
- Specified by:
isValidNumberin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.minValue- Lowest legal value for input.maxValue- Highest legal value for input.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid number -
- Throws: -
IntrusionException
- -
-getValidNumber
--public java.lang.Double getValidNumber(java.lang.String context, - java.lang.String input, - long minValue, - long maxValue, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a validated number as a double. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
getValidNumberin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.minValue- Lowest legal value for input.maxValue- Highest legal value for input. -- Returns:
- A validated number as a double. -
- Throws: -
ValidationException-IntrusionException
- -
-getValidNumber
--public java.lang.Double getValidNumber(java.lang.String context, - java.lang.String input, - long minValue, - long maxValue, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- Description copied from interface:
Validator
- - Returns a validated number as a double within the range of minValue to maxValue. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Specified by:
getValidNumberin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.minValue- Lowest legal value for input.maxValue- Highest legal value for input.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A validated number as a double. -
- Throws: -
IntrusionException
- -
-isValidDouble
--public boolean isValidDouble(java.lang.String context, - java.lang.String input, - double minValue, - double maxValue, - boolean allowNull) - throws IntrusionException-
-
-
- Description copied from interface:
Validator
- - Returns true if input is a valid double within the range of minValue to maxValue.
-
-
-
-
- Specified by:
isValidDoublein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.minValue- Lowest legal value for input.maxValue- Highest legal value for input.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid double. -
- Throws: -
IntrusionException
- -
-getValidDouble
--public java.lang.Double getValidDouble(java.lang.String context, - java.lang.String input, - double minValue, - double maxValue, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a validated number as a double. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
getValidDoublein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.minValue- Lowest legal value for input.maxValue- Highest legal value for input. -- Returns:
- A validated real number as a double. -
- Throws: -
IntrusionException-ValidationException
- -
-getValidDouble
--public java.lang.Double getValidDouble(java.lang.String context, - java.lang.String input, - double minValue, - double maxValue, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- Description copied from interface:
Validator
- - Returns a validated real number as a double. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Specified by:
getValidDoublein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.minValue- Lowest legal value for input.maxValue- Highest legal value for input.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A validated real number as a double. -
- Throws: -
IntrusionException
- -
-isValidInteger
--public boolean isValidInteger(java.lang.String context, - java.lang.String input, - int minValue, - int maxValue, - boolean allowNull) - throws IntrusionException-
-
-
- Description copied from interface:
Validator
- - Returns true if input is a valid integer within the range of minValue to maxValue.
-
-
-
-
- Specified by:
isValidIntegerin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.minValue- Lowest legal value for input.maxValue- Highest legal value for input.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input is a valid integer -
- Throws: -
IntrusionException
- -
-getValidInteger
--public java.lang.Integer getValidInteger(java.lang.String context, - java.lang.String input, - int minValue, - int maxValue, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a validated number as a double. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
getValidIntegerin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.minValue- Lowest legal value for input.maxValue- Highest legal value for input. -- Returns:
- A validated number as an integer. -
- Throws: -
IntrusionException-ValidationException
- -
-getValidInteger
--public java.lang.Integer getValidInteger(java.lang.String context, - java.lang.String input, - int minValue, - int maxValue, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- Description copied from interface:
Validator
- - Returns a validated integer. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Specified by:
getValidIntegerin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.minValue- Lowest legal value for input.maxValue- Highest legal value for input.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A validated number as an integer. -
- Throws: -
IntrusionException
- -
-isValidFileContent
--public boolean isValidFileContent(java.lang.String context, - byte[] input, - int maxBytes, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is valid file content.
-
-
-
-
- Specified by:
isValidFileContentin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.maxBytes- The maximum number of bytes allowed in a legal file.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if input contains valid file content. -
- Throws: -
IntrusionException
- -
-getValidFileContent
--public byte[] getValidFileContent(java.lang.String context, - byte[] input, - int maxBytes, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns validated file content as a byte array. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
getValidFileContentin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.maxBytes- The maximum number of bytes allowed in a legal file.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- A byte array containing valid file content. -
- Throws: -
IntrusionException-ValidationException
- -
-getValidFileContent
--public byte[] getValidFileContent(java.lang.String context, - byte[] input, - int maxBytes, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- Description copied from interface:
Validator
- - Returns validated file content as a byte array. This is a good place to check for max file size, allowed character sets, and do virus scans. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException. Instead of throwing a ValidationException
- on error, this variant will store the exception inside of the ValidationErrorList.
-
-
-
-
- Specified by:
getValidFileContentin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The actual input data to validate.maxBytes- The maximum number of bytes allowed in a legal file.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If validation is in error, resulting error will be stored in the errorList by context. -- Returns:
- A byte array containing valid file content. -
- Throws: -
IntrusionException
- -
-isValidFileUpload
--public boolean isValidFileUpload(java.lang.String context, - java.lang.String directorypath, - java.lang.String filename, - byte[] content, - int maxBytes, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if a file upload has a valid name, path, and content.
-
-
-
-
- Specified by:
isValidFileUploadin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.directorypath- The file path of the uploaded file.filename- The filename of the uploaded filecontent- A byte array containing the content of the uploaded file.maxBytes- The max number of bytes allowed for a legal file upload.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if a file upload has a valid name, path, and content. -
- Throws: -
IntrusionException
- -
-assertValidFileUpload
--public void assertValidFileUpload(java.lang.String context, - java.lang.String directorypath, - java.lang.String filename, - byte[] content, - int maxBytes, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Validates the filepath, filename, and content of a file. Invalid input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
assertValidFileUploadin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.directorypath- The file path of the uploaded file.filename- The filename of the uploaded filecontent- A byte array containing the content of the uploaded file.maxBytes- The max number of bytes allowed for a legal file upload.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Throws: -
ValidationException-IntrusionException
- -
-assertValidFileUpload
--public void assertValidFileUpload(java.lang.String context, - java.lang.String filepath, - java.lang.String filename, - byte[] content, - int maxBytes, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- ValidationErrorList variant of assertValidFileUpload
-
-
-
-
- Specified by:
assertValidFileUploadin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.filepath- The file path of the uploaded file.filename- The filename of the uploaded filecontent- A byte array containing the content of the uploaded file.maxBytes- The max number of bytes allowed for a legal file upload.allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If validation is in error, resulting error will be stored in the errorList by context -- Throws: -
IntrusionException
- -
-isValidHTTPRequest
--public boolean isValidHTTPRequest() - throws IntrusionException-
-
-
- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed
- characters. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
- Uses current HTTPRequest saved in EASPI Authenticator
-
-
-
-
- Specified by:
isValidHTTPRequestin interfaceValidator
-
-
-
- Returns:
- true, if is a valid HTTP request -
- Throws: -
IntrusionException
- -
-isValidHTTPRequest
--public boolean isValidHTTPRequest(javax.servlet.http.HttpServletRequest request) - throws IntrusionException-
-
-
- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed
- characters. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
-
-
-
- Throws: -
IntrusionException
- -
-assertIsValidHTTPRequest
--public void assertIsValidHTTPRequest() - throws ValidationException, - IntrusionException-
-
-
- Validates the current HTTP request by comparing parameters, headers, and cookies to a predefined whitelist of allowed
- characters. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
- Uses current HTTPRequest saved in EASPI Authenticator
-
-
-
-
- Specified by:
assertIsValidHTTPRequestin interfaceValidator
-
-
-
- Throws: -
ValidationException-IntrusionException
- -
-isValidListItem
--public boolean isValidListItem(java.lang.String context, - java.lang.String input, - java.util.List list)-
-
-
- Description copied from interface:
Validator
- - Returns true if input is a valid list item.
-
-
-
-
- Specified by:
isValidListItemin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The value to search 'list' for.list- The list to search for 'input'. -- Returns:
- true, if 'input' was found in 'list'.
- -
-getValidListItem
--public java.lang.String getValidListItem(java.lang.String context, - java.lang.String input, - java.util.List list) - throws ValidationException, - IntrusionException-
-
-
- Returns the list item that exactly matches the canonicalized input. Invalid or non-matching input
- will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
getValidListItemin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The value to search 'list' for.list- The list to search for 'input'. -- Returns:
- The list item that exactly matches the canonicalized input. -
- Throws: -
IntrusionException-ValidationException
- -
-getValidListItem
--public java.lang.String getValidListItem(java.lang.String context, - java.lang.String input, - java.util.List list, - ValidationErrorList errors) - throws IntrusionException-
-
-
- ValidationErrorList variant of getValidListItem
-
-
-
-
- Specified by:
getValidListItemin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- The value to search 'list' for.list- The list to search for 'input'.errors- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- The list item that exactly matches the canonicalized input. -
- Throws: -
IntrusionException
- -
-isValidHTTPRequestParameterSet
--public boolean isValidHTTPRequestParameterSet(java.lang.String context, - java.util.Set requiredNames, - java.util.Set optionalNames)-
-
-
- Description copied from interface:
Validator
- - Returns true if the parameters in the current request contain all required parameters and only optional ones in addition.
-
-
-
-
- Specified by:
isValidHTTPRequestParameterSetin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.requiredNames- parameters that are required to be in HTTP requestoptionalNames- additional parameters that may be in HTTP request -- Returns:
- true, if all required parameters are in HTTP request and only optional parameters in addition. Returns false if parameters are found in HTTP request that are not in either set (required or optional), or if any required parameters are missing from request.
- -
-assertIsValidHTTPRequestParameterSet
--public void assertIsValidHTTPRequestParameterSet(java.lang.String context, - java.util.Set required, - java.util.Set optional) - throws ValidationException, - IntrusionException-
-
-
- Validates that the parameters in the current request contain all required parameters and only optional ones in
- addition. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
assertIsValidHTTPRequestParameterSetin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.required- parameters that are required to be in HTTP requestoptional- additional parameters that may be in HTTP request -- Throws: -
ValidationException-IntrusionException
- -
-assertIsValidHTTPRequestParameterSet
--public void assertIsValidHTTPRequestParameterSet(java.lang.String context, - java.util.Set required, - java.util.Set optional, - ValidationErrorList errors) - throws IntrusionException-
-
-
- ValidationErrorList variant of assertIsValidHTTPRequestParameterSet
-
-
-
-
- Specified by:
assertIsValidHTTPRequestParameterSetin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.required- parameters that are required to be in HTTP requestoptional- additional parameters that may be in HTTP requesterrors- If validation is in error, resulting error will be stored in the errorList by context -- Throws: -
IntrusionException
- -
-isValidPrintable
--public boolean isValidPrintable(java.lang.String context, - byte[] input, - int maxLength, - boolean allowNull) - throws IntrusionException-
-
-
- Checks that all bytes are valid ASCII characters (between 33 and 126
- inclusive). This implementation does no decoding. http://en.wikipedia.org/wiki/ASCII. (non-Javadoc)
-
-
-
-
- Specified by:
isValidPrintablein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- data to be checked for validitymaxLength- Maximum number of bytes stored in 'input'allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if 'input' is less than maxLength and contains only valid, printable characters -
- Throws: -
IntrusionException- See Also:
org.owasp.esapi.Validator#isValidASCIIFileContent(byte[])
- -
-getValidPrintable
--public byte[] getValidPrintable(java.lang.String context, - byte[] input, - int maxLength, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns canonicalized and validated printable characters as a byte array. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
getValidPrintablein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- data to be returned as valid and printablemaxLength- Maximum number of bytes stored in 'input'allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- a byte array containing only printable characters, made up of data from 'input' -
- Throws: -
ValidationException-IntrusionException
- -
-getValidPrintable
--public byte[] getValidPrintable(java.lang.String context, - byte[] input, - int maxLength, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- ValidationErrorList variant of getValidPrintable
-
-
-
-
- Specified by:
getValidPrintablein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- data to be returned as valid and printablemaxLength- Maximum number of bytes stored in 'input'allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- a byte array containing only printable characters, made up of data from 'input' -
- Throws: -
IntrusionException
- -
-isValidPrintable
--public boolean isValidPrintable(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull) - throws IntrusionException-
-
-
- Description copied from interface:
Validator
- - Returns true if input contains only valid printable ASCII characters (32-126).
-
-
-
-
- Specified by:
isValidPrintablein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- data to be checked for validitymaxLength- Maximum number of bytes stored in 'input' after canonicalizationallowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if 'input' is less than maxLength after canonicalization and contains only valid, printable characters -
- Throws: -
IntrusionException
- -
-getValidPrintable
--public java.lang.String getValidPrintable(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns canonicalized and validated printable characters as a String. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
getValidPrintablein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- data to be returned as valid and printablemaxLength- Maximum number of bytes stored in 'input' after canonicalizationallowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- a String containing only printable characters, made up of data from 'input' -
- Throws: -
ValidationException-IntrusionException
- -
-getValidPrintable
--public java.lang.String getValidPrintable(java.lang.String context, - java.lang.String input, - int maxLength, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- ValidationErrorList variant of getValidPrintable
-
-
-
-
- Specified by:
getValidPrintablein interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- data to be returned as valid and printablemaxLength- Maximum number of bytes stored in 'input' after canonicalizationallowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- a String containing only printable characters, made up of data from 'input' -
- Throws: -
IntrusionException
- -
-isValidRedirectLocation
--public boolean isValidRedirectLocation(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws IntrusionException-
-
-
- Returns true if input is a valid redirect location.
-
-
-
-
- Specified by:
isValidRedirectLocationin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- redirect location to be checked for validity, according to rules set in "ESAPI.properties"allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- true, if 'input' is a valid redirect location, as defined by "ESAPI.properties", false otherwise. -
- Throws: -
IntrusionException
- -
-getValidRedirectLocation
--public java.lang.String getValidRedirectLocation(java.lang.String context, - java.lang.String input, - boolean allowNull) - throws ValidationException, - IntrusionException-
-
-
- Returns a canonicalized and validated redirect location as a String. Invalid input will generate a descriptive ValidationException, and input that is clearly an attack
- will generate a descriptive IntrusionException.
-
-
-
-
- Specified by:
getValidRedirectLocationin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- redirect location to be returned as valid, according to encoding rules set in "ESAPI.properties"allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException. -- Returns:
- A canonicalized and validated redirect location, as defined in "ESAPI.properties" -
- Throws: -
IntrusionException-ValidationException
- -
-getValidRedirectLocation
--public java.lang.String getValidRedirectLocation(java.lang.String context, - java.lang.String input, - boolean allowNull, - ValidationErrorList errors) - throws IntrusionException-
-
-
- ValidationErrorList variant of getValidRedirectLocation
-
-
-
-
- Specified by:
getValidRedirectLocationin interfaceValidator
-
-
- Parameters:
context- A descriptive name of the parameter that you are validating (e.g., LoginPage_UsernameField). This value is used by any logging or error handling that is done with respect to the value passed in.input- redirect location to be returned as valid, according to encoding rules set in "ESAPI.properties"allowNull- If allowNull is true then an input that is NULL or an empty string will be legal. If allowNull is false then NULL or an empty String will throw a ValidationException.errors- If validation is in error, resulting error will be stored in the errorList by context -- Returns:
- A canonicalized and validated redirect location, as defined in "ESAPI.properties" -
- Throws: -
IntrusionException
- -
-safeReadLine
--public java.lang.String safeReadLine(java.io.InputStream in, - int max) - throws ValidationException-
-
-
- This implementation reads until a newline or the specified number of
- characters.
-
-
-
-
- Specified by:
safeReadLinein interfaceValidator
-
-
- Parameters:
in- the inmax- the max -- Returns:
- the string -
- Throws: -
ValidationException- the validation exception- See Also:
Validator.safeReadLine(java.io.InputStream, - int)
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/EncoderTest.html b/javadoc/org/owasp/esapi/reference/EncoderTest.html deleted file mode 100644 index 479145361..000000000 --- a/javadoc/org/owasp/esapi/reference/EncoderTest.html +++ /dev/null @@ -1,656 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class EncoderTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class EncoderTest
- extends junit.framework.TestCase
-The Class EncoderTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
EncoderTest(java.lang.String testName)
-
-- Instantiates a new encoder test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testCanonicalize()
-
-- Test of canonicalize method, of class org.owasp.esapi.Encoder. |
-
- void |
-testDecodeFromBase64()
-
-- Test of decodeFromBase64 method, of class org.owasp.esapi.Encoder. |
-
- void |
-testDecodeFromURL()
-
-- Test of decodeFromURL method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForBase64()
-
-- Test of encodeForBase64 method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForCSS()
-
-- |
-
- void |
-testEncodeForDN()
-
-- Test of encodeForLDAP method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForHTML()
-
-- Test of encodeForHTML method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForHTMLAttribute()
-
-- Test of encodeForHTMLAttribute method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForJavascript()
-
-- Test of encodeForJavaScript method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForLDAP()
-
-- Test of encodeForLDAP method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForSQL()
-
-- Test of encodeForSQL method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForURL()
-
-- Test of encodeForURL method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForVBScript()
-
-- |
-
- void |
-testEncodeForXML()
-
-- Test of encodeForXML method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForXMLAttribute()
-
-- Test of encodeForXMLAttribute method, of class org.owasp.esapi.Encoder. |
-
- void |
-testEncodeForXPath()
-
-- Test of encodeForXPath method, of class org.owasp.esapi.Encoder. |
-
- void |
-testNormalize()
-
-- Test of normalize method, of class org.owasp.esapi.Validator. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-EncoderTest
--public EncoderTest(java.lang.String testName)-
-
-
- Instantiates a new encoder test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testCanonicalize
--public void testCanonicalize() - throws EncodingException-
-
-
- Test of canonicalize method, of class org.owasp.esapi.Encoder.
-
-
-
-
-
- Throws: -
EncodingException
- -
-testNormalize
--public void testNormalize() - throws ValidationException-
-
-
- Test of normalize method, of class org.owasp.esapi.Validator.
-
-
-
-
-
- Throws: -
ValidationException- the validation exception
- -
-testEncodeForHTML
--public void testEncodeForHTML() - throws java.lang.Exception-
-
-
- Test of encodeForHTML method, of class org.owasp.esapi.Encoder.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testEncodeForHTMLAttribute
--public void testEncodeForHTMLAttribute()-
-
-
- Test of encodeForHTMLAttribute method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForCSS
--public void testEncodeForCSS()-
-
-
-
-
-
- -
-testEncodeForJavascript
--public void testEncodeForJavascript()-
-
-
- Test of encodeForJavaScript method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForVBScript
--public void testEncodeForVBScript()-
-
-
-
-
-
- -
-testEncodeForXPath
--public void testEncodeForXPath()-
-
-
- Test of encodeForXPath method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForSQL
--public void testEncodeForSQL()-
-
-
- Test of encodeForSQL method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForLDAP
--public void testEncodeForLDAP()-
-
-
- Test of encodeForLDAP method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForDN
--public void testEncodeForDN()-
-
-
- Test of encodeForLDAP method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForXML
--public void testEncodeForXML()-
-
-
- Test of encodeForXML method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForXMLAttribute
--public void testEncodeForXMLAttribute()-
-
-
- Test of encodeForXMLAttribute method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testEncodeForURL
--public void testEncodeForURL() - throws java.lang.Exception-
-
-
- Test of encodeForURL method, of class org.owasp.esapi.Encoder.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testDecodeFromURL
--public void testDecodeFromURL() - throws java.lang.Exception-
-
-
- Test of decodeFromURL method, of class org.owasp.esapi.Encoder.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testEncodeForBase64
--public void testEncodeForBase64()-
-
-
- Test of encodeForBase64 method, of class org.owasp.esapi.Encoder.
-
-
-
-
- -
-testDecodeFromBase64
--public void testDecodeFromBase64()-
-
-
- Test of decodeFromBase64 method, of class org.owasp.esapi.Encoder.
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/EncryptedPropertiesTest.html b/javadoc/org/owasp/esapi/reference/EncryptedPropertiesTest.html deleted file mode 100644 index 7756608f9..000000000 --- a/javadoc/org/owasp/esapi/reference/EncryptedPropertiesTest.html +++ /dev/null @@ -1,432 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class EncryptedPropertiesTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class EncryptedPropertiesTest
- extends junit.framework.TestCase
-The Class EncryptedPropertiesTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
EncryptedPropertiesTest(java.lang.String testName)
-
-- Instantiates a new encrypted properties test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testGetProperty()
-
-- Test of getProperty method, of class org.owasp.esapi.EncryptedProperties. |
-
- void |
-testKeySet()
-
-- Test of keySet method, of class org.owasp.esapi.EncryptedProperties. |
-
- void |
-testLoad()
-
-- Test of load method, of class org.owasp.esapi.EncryptedProperties. |
-
- void |
-testMain()
-
-- Test of store method, of class org.owasp.esapi.EncryptedProperties. |
-
- void |
-testSetProperty()
-
-- Test of setProperty method, of class org.owasp.esapi.EncryptedProperties. |
-
- void |
-testStore()
-
-- Test of store method, of class org.owasp.esapi.EncryptedProperties. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-EncryptedPropertiesTest
--public EncryptedPropertiesTest(java.lang.String testName)-
-
-
- Instantiates a new encrypted properties test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testGetProperty
--public void testGetProperty() - throws EncryptionException-
-
-
- Test of getProperty method, of class org.owasp.esapi.EncryptedProperties.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception
- -
-testSetProperty
--public void testSetProperty() - throws EncryptionException-
-
-
- Test of setProperty method, of class org.owasp.esapi.EncryptedProperties.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception
- -
-testKeySet
--public void testKeySet() - throws java.lang.Exception-
-
-
- Test of keySet method, of class org.owasp.esapi.EncryptedProperties.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testLoad
--public void testLoad() - throws java.lang.Exception-
-
-
- Test of load method, of class org.owasp.esapi.EncryptedProperties.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testStore
--public void testStore() - throws java.lang.Exception-
-
-
- Test of store method, of class org.owasp.esapi.EncryptedProperties.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testMain
--public void testMain() - throws java.lang.Exception-
-
-
- Test of store method, of class org.owasp.esapi.EncryptedProperties.
-
-
-
-
-
- Throws: -
java.lang.Exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/EncryptorTest.html b/javadoc/org/owasp/esapi/reference/EncryptorTest.html deleted file mode 100644 index 066141f6a..000000000 --- a/javadoc/org/owasp/esapi/reference/EncryptorTest.html +++ /dev/null @@ -1,455 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class EncryptorTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class EncryptorTest
- extends junit.framework.TestCase
-The Class EncryptorTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
EncryptorTest(java.lang.String testName)
-
-- Instantiates a new encryptor test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testDecrypt()
-
-- Test of decrypt method, of class org.owasp.esapi.Encryptor. |
-
- void |
-testEncrypt()
-
-- Test of encrypt method, of class org.owasp.esapi.Encryptor. |
-
- void |
-testHash()
-
-- Test of hash method, of class org.owasp.esapi.Encryptor. |
-
- void |
-testSeal()
-
-- Test of seal method, of class org.owasp.esapi.Encryptor. |
-
- void |
-testSign()
-
-- Test of sign method, of class org.owasp.esapi.Encryptor. |
-
- void |
-testVerifySeal()
-
-- Test of verifySeal method, of class org.owasp.esapi.Encryptor. |
-
- void |
-testVerifySignature()
-
-- Test of verifySignature method, of class org.owasp.esapi.Encryptor. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-EncryptorTest
--public EncryptorTest(java.lang.String testName)-
-
-
- Instantiates a new encryptor test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testHash
--public void testHash() - throws EncryptionException-
-
-
- Test of hash method, of class org.owasp.esapi.Encryptor.
-
-
-
-
-
- Throws: -
EncryptionException
- -
-testEncrypt
--public void testEncrypt() - throws EncryptionException-
-
-
- Test of encrypt method, of class org.owasp.esapi.Encryptor.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception
- -
-testDecrypt
--public void testDecrypt()-
-
-
- Test of decrypt method, of class org.owasp.esapi.Encryptor.
-
-
-
-
- -
-testSign
--public void testSign() - throws EncryptionException-
-
-
- Test of sign method, of class org.owasp.esapi.Encryptor.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception
- -
-testVerifySignature
--public void testVerifySignature() - throws EncryptionException-
-
-
- Test of verifySignature method, of class org.owasp.esapi.Encryptor.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception
- -
-testSeal
--public void testSeal() - throws IntegrityException-
-
-
- Test of seal method, of class org.owasp.esapi.Encryptor.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception -IntegrityException
- -
-testVerifySeal
--public void testVerifySeal() - throws EnterpriseSecurityException-
-
-
- Test of verifySeal method, of class org.owasp.esapi.Encryptor.
-
-
-
-
-
- Throws: -
EncryptionException- the encryption exception -EnterpriseSecurityException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/ExecutorTest.html b/javadoc/org/owasp/esapi/reference/ExecutorTest.html deleted file mode 100644 index e23bf2561..000000000 --- a/javadoc/org/owasp/esapi/reference/ExecutorTest.html +++ /dev/null @@ -1,312 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class ExecutorTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class ExecutorTest
- extends junit.framework.TestCase
-The Class ExecutorTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
ExecutorTest(java.lang.String testName)
-
-- Instantiates a new executor test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testExecuteSystemCommand()
-
-- Test of executeOSCommand method, of class org.owasp.esapi.Executor |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ExecutorTest
--public ExecutorTest(java.lang.String testName)-
-
-
- Instantiates a new executor test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testExecuteSystemCommand
--public void testExecuteSystemCommand() - throws java.lang.Exception-
-
-
- Test of executeOSCommand method, of class org.owasp.esapi.Executor
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/FileBasedAccessController.html b/javadoc/org/owasp/esapi/reference/FileBasedAccessController.html deleted file mode 100644 index 2fcd57263..000000000 --- a/javadoc/org/owasp/esapi/reference/FileBasedAccessController.html +++ /dev/null @@ -1,588 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class FileBasedAccessController
--java.lang.Object --
-
-
- All Implemented Interfaces:
- AccessController -
-
-
-
- public class FileBasedAccessController
- extends java.lang.Object
- implements AccessController
- extends java.lang.Object
-Reference implementation of the AccessController interface. This reference - implementation uses a simple model for specifying a set of access control - rules. Many organizations will want to create their own implementation of the - methods provided in the IAccessController interface. -
- This reference implementation uses a simple scheme for specifying the rules. - The first step is to create a namespace for the resources being accessed. For - files and URL's, this is easy as they already have a namespace. Be extremely - careful about canonicalizing when relying on information from the user in an - access ctnrol decision. -
- For functions, data, and services, you will have to come up with your own - namespace for the resources being accessed. You might simply define a flat - namespace with a list of category names. For example, you might specify - 'FunctionA', 'FunctionB', and 'FunctionC'. Or you can create a richer - namespace with a hierarchical structure, such as: -
- /functions -
-
-
- purchasing -
- shipping -
- inventory -
-
-
- createUser -
- deleteUser -
- There is a single configuration file supporting each of the five methods in - the IAccessController interface. These files are located in the ESAPI - resources directory as specified when the JVM was started. The use of a - default deny rule is STRONGLY recommended. The file format is as follows: - -
- path | role,role | allow/deny | comment - ------------------------------------------------------------------------------------ - /banking/* | user,admin | allow | authenticated users can access /banking - /admin | admin | allow | only admin role can access /admin - / | any | deny | default deny rule -- - To find the matching rules, this implementation follows the general approach - used in Java EE when matching HTTP requests to servlets in web.xml. The - four mapping rules are used in the following order: -
-
-
- exact match, e.g. /access/login -
- longest path prefix match, beginning / and ending /*, e.g. /access/* or /* -
- extension match, beginning *., e.g. *.css -
- default rule, specified by the single character pattern / -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
AccessController
- -
| -Constructor Summary | -|
FileBasedAccessController()
-
-- |
-|
| -Method Summary | -|
- void |
-assertAuthorizedForData(java.lang.String key)
-
-- Checks if an account is authorized to access the referenced data. |
-
- void |
-assertAuthorizedForFile(java.lang.String filepath)
-
-- Checks if an account is authorized to access the referenced file. |
-
- void |
-assertAuthorizedForFunction(java.lang.String functionName)
-
-- Checks if an account is authorized to access the referenced function. |
-
- void |
-assertAuthorizedForService(java.lang.String serviceName)
-
-- Checks if an account is authorized to access the referenced service. |
-
- void |
-assertAuthorizedForURL(java.lang.String url)
-
-- Checks if an account is authorized to access the referenced URL. |
-
- boolean |
-isAuthorizedForData(java.lang.String key)
-
-- Checks if an account is authorized to access the referenced data. |
-
- boolean |
-isAuthorizedForFile(java.lang.String filepath)
-
-- Checks if an account is authorized to access the referenced file. |
-
- boolean |
-isAuthorizedForFunction(java.lang.String functionName)
-
-- Checks if an account is authorized to access the referenced function. |
-
- boolean |
-isAuthorizedForService(java.lang.String serviceName)
-
-- Checks if an account is authorized to access the referenced service. |
-
- boolean |
-isAuthorizedForURL(java.lang.String url)
-
-- Checks if an account is authorized to access the referenced URL. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-FileBasedAccessController
--public FileBasedAccessController()-
-
-
| -Method Detail | -
-isAuthorizedForURL
--public boolean isAuthorizedForURL(java.lang.String url)-
-
-
- Description copied from interface:
AccessController
- - Checks if an account is authorized to access the referenced URL. The implementation should allow
- access to be granted to any part of the URL. Generally, this method should be invoked in the
- application's controller or a filter as follows:
-
ESAPI.accessController().isAuthorizedForURL(request.getRequestURI().toString());
--
-
-
- Specified by:
isAuthorizedForURLin interfaceAccessController
-
-
-
- Returns:
- true, if is authorized for URL
- -
-isAuthorizedForFunction
--public boolean isAuthorizedForFunction(java.lang.String functionName)-
-
-
- Description copied from interface:
AccessController
- - Checks if an account is authorized to access the referenced function. The implementation should define the
- function "namespace" to be enforced. Choosing something simple like the classname of action classes or menu item
- names will make this implementation easier to use.
-
-
-
-
- Specified by:
isAuthorizedForFunctionin interfaceAccessController
-
-
- Parameters:
functionName- the function name -- Returns:
- true, if is authorized for function
- -
-isAuthorizedForData
--public boolean isAuthorizedForData(java.lang.String key)-
-
-
- Description copied from interface:
AccessController
- - Checks if an account is authorized to access the referenced data. The implementation should define the data
- "namespace" to be enforced.
-
-
-
-
- Specified by:
isAuthorizedForDatain interfaceAccessController
-
-
- Parameters:
key- the key -- Returns:
- true, if is authorized for data
- -
-isAuthorizedForFile
--public boolean isAuthorizedForFile(java.lang.String filepath)-
-
-
- Description copied from interface:
AccessController
- - Checks if an account is authorized to access the referenced file. The implementation should be extremely careful
- about canonicalization.
-
-
-
-
- Specified by:
isAuthorizedForFilein interfaceAccessController
-
-
- Parameters:
filepath- the path of the file to be checked, including filename -- Returns:
- true, if is authorized for file
- See Also:
Encoder.canonicalize(String)
- -
-isAuthorizedForService
--public boolean isAuthorizedForService(java.lang.String serviceName)-
-
-
- Description copied from interface:
AccessController
- - Checks if an account is authorized to access the referenced service. This can be used in applications that
- provide access to a variety of backend services.
-
-
-
-
- Specified by:
isAuthorizedForServicein interfaceAccessController
-
-
- Parameters:
serviceName- the service name -- Returns:
- true, if is authorized for service
- -
-assertAuthorizedForURL
--public void assertAuthorizedForURL(java.lang.String url) - throws AccessControlException-
-
-
- Description copied from interface:
AccessController
- - Checks if an account is authorized to access the referenced URL. The implementation should allow
- access to be granted to any part of the URL. Generally, this method should be invoked in the
- application's controller or a filter as follows:
-
ESAPI.accessController().assertAuthorizedForURL(request.getRequestURI().toString());
--
-
-
- Specified by:
assertAuthorizedForURLin interfaceAccessController
-
-
- Parameters:
url- the url as returned by request.getRequestURI().toString() -- Throws: -
AccessControlException- if access is not permitted
- -
-assertAuthorizedForFunction
--public void assertAuthorizedForFunction(java.lang.String functionName) - throws AccessControlException-
-
-
- Description copied from interface:
AccessController
- - Checks if an account is authorized to access the referenced function. The implementation should define the
- function "namespace" to be enforced. Choosing something simple like the classname of action classes or menu item
- names will make this implementation easier to use.
-
-
-
-
- Specified by:
assertAuthorizedForFunctionin interfaceAccessController
-
-
- Parameters:
functionName- the function name -- Throws: -
AccessControlException- if access is not permitted
- -
-assertAuthorizedForData
--public void assertAuthorizedForData(java.lang.String key) - throws AccessControlException-
-
-
- Description copied from interface:
AccessController
- - Checks if an account is authorized to access the referenced data. The implementation should define the data
- "namespace" to be enforced.
-
-
-
-
- Specified by:
assertAuthorizedForDatain interfaceAccessController
-
-
- Parameters:
key- the key -- Throws: -
AccessControlException- is access is not permitted
- -
-assertAuthorizedForFile
--public void assertAuthorizedForFile(java.lang.String filepath) - throws AccessControlException-
-
-
- Description copied from interface:
AccessController
- - Checks if an account is authorized to access the referenced file. The implementation should be extremely careful
- about canonicalization.
-
-
-
-
- Specified by:
assertAuthorizedForFilein interfaceAccessController
-
-
- Parameters:
filepath- the path of the file to be checked, including filename -- Throws: -
AccessControlException- is access is not permitted- See Also:
Encoder.canonicalize(String)
- -
-assertAuthorizedForService
--public void assertAuthorizedForService(java.lang.String serviceName) - throws AccessControlException-
-
-
- Description copied from interface:
AccessController
- - Checks if an account is authorized to access the referenced service. This can be used in applications that
- provide access to a variety of backend services.
-
-
-
-
- Specified by:
assertAuthorizedForServicein interfaceAccessController
-
-
- Parameters:
serviceName- the service name -- Throws: -
AccessControlException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/FileBasedAuthenticator.html b/javadoc/org/owasp/esapi/reference/FileBasedAuthenticator.html deleted file mode 100644 index 8c749791c..000000000 --- a/javadoc/org/owasp/esapi/reference/FileBasedAuthenticator.html +++ /dev/null @@ -1,827 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class FileBasedAuthenticator
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Authenticator -
-
-
-
- public class FileBasedAuthenticator
- extends java.lang.Object
- implements Authenticator
- extends java.lang.Object
-Reference implementation of the Authenticator interface. This reference implementation is backed by a simple text - file that contains serialized information about users. Many organizations will want to create their own - implementation of the methods provided in the IAuthenticator interface backed by their own user repository. This - reference implementation captures information about users in a simple text file format that contains user information - separated by the pipe "|" character. Here's an example of a single line from the users.txt file: - -
- - account id | account name | hashed password | roles | lockout | status | old password hashes | last - hostname | last change | last login | last failed | expiration | failed - --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- - 1203123710837 | mitch | 44k/NAzQUlrCq9musTGGkcMNmdzEGJ8w8qZTLzpxLuQ= | admin,user | unlocked | enabled | - u10dW4vTo3ZkoM5xP+blayWCz7KdPKyKUojOn9GJobg= | 192.168.1.255 | 1187201000926 | 1187200991568 | 1187200605330 | - 2187200605330 | 1 - --
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams at Aspect Security -
- See Also:
Authenticator
- -
| -Constructor Summary | -|
FileBasedAuthenticator()
-
-- |
-|
| -Method Summary | -|
- void |
-changePassword(User user,
- java.lang.String currentPassword,
- java.lang.String newPassword,
- java.lang.String newPassword2)
-
-- Changes the password for the specified user. |
-
- void |
-clearCurrent()
-
-- Clears all threadlocal variables from the thread. |
-
- User |
-createUser(java.lang.String accountName,
- java.lang.String password1,
- java.lang.String password2)
-
-- Creates a new User with the information provided. |
-
- boolean |
-exists(java.lang.String accountName)
-
-- Determine if the account exists. |
-
- java.lang.String |
-generateStrongPassword()
-
-- Generate a strong password. |
-
- java.lang.String |
-generateStrongPassword(User user,
- java.lang.String oldPassword)
-
-- Generate strong password that takes into account the user's information and old password. |
-
- User |
-getCurrentUser()
-
-- Returns the currently logged in User. |
-
- User |
-getUser(long accountId)
-
-- Gets the user object with the matching account name or null if there is no match. |
-
- User |
-getUser(java.lang.String accountName)
-
-- Gets the user object with the matching account name or null if there is no match. |
-
- java.util.Set |
-getUserNames()
-
-- Gets the user names. |
-
- java.lang.String |
-hashPassword(java.lang.String password,
- java.lang.String accountName)
-
-- Returns a string representation of the hashed password, using the - accountName as the salt. |
-
- User |
-login(javax.servlet.http.HttpServletRequest request,
- javax.servlet.http.HttpServletResponse response)
-
-- This method should be called for every HTTP request, to login the current user either from the session of HTTP - request. |
-
- void |
-logout()
-
-- Log out the current user. |
-
-static void |
-main(java.lang.String[] args)
-
-- Fail safe main program to add or update an account in an emergency. |
-
- void |
-removeUser(java.lang.String accountName)
-
-- Removes the account. |
-
- void |
-setCurrentUser(User user)
-
-- Sets the currently logged in User. |
-
- void |
-verifyAccountNameStrength(java.lang.String newAccountName)
-
-- Ensures that the account name passes site-specific complexity requirements, like minimum length. |
-
- boolean |
-verifyPassword(User user,
- java.lang.String password)
-
-- Verify that the supplied password matches the password for this user. |
-
- void |
-verifyPasswordStrength(java.lang.String oldPassword,
- java.lang.String newPassword)
-
-- Ensures that the password meets site-specific complexity requirements. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-FileBasedAuthenticator
--public FileBasedAuthenticator()-
-
-
| -Method Detail | -
-main
--public static void main(java.lang.String[] args) - throws java.lang.Exception-
-
-
- Fail safe main program to add or update an account in an emergency.
-
- Warning: this method does not perform the level of validation and checks - generally required in ESAPI, and can therefore be used to create a username and password that do not comply - with the username and password strength requirements. -
- Example: Use this to add the alice account with the admin role to the users file: -
- - java -Dorg.owasp.esapi.resources="/path/resources" -classpath esapi.jar org.owasp.esapi.Authenticator alice password admin - -
--
-
-
-
-
- Parameters:
args- the args -- Throws: -
AuthenticationException- the authentication exception -java.lang.Exception
- -
-clearCurrent
--public void clearCurrent()-
-
-
- Clears all threadlocal variables from the thread. This should ONLY be called after
- all possible ESAPI operations have concluded. If you clear too early, many calls will
- fail, including logging, which requires the user identity.
-
-
-
-
- Specified by:
clearCurrentin interfaceAuthenticator
-
-
- -
-createUser
--public User createUser(java.lang.String accountName, - java.lang.String password1, - java.lang.String password2) - throws AuthenticationException-
-
-
- Description copied from interface:
Authenticator
- - Creates a new User with the information provided. Implementations should check the
- accountName and password for proper format and strength against brute force attacks.
- Two copies of the new password are required to encourage user interface designers to
- include a "re-type password" field in their forms. Implementations should verify that both are the
- same.
-
-
-
-
- Specified by:
createUserin interfaceAuthenticator
-
-
- Parameters:
accountName- the account name of the new userpassword1- the password of the new userpassword2- the password of the new user. This field is to encourage user interface designers to include two password fields in their forms. -- Returns:
- the User that has been created -
- Throws: -
AuthenticationException- if user creation fails
- -
-exists
--public boolean exists(java.lang.String accountName)-
-
-
- Description copied from interface:
Authenticator
- - Determine if the account exists.
-
-
-
-
- Specified by:
existsin interfaceAuthenticator
-
-
- Parameters:
accountName- the account name -- Returns:
- true, if the account exists
- -
-generateStrongPassword
--public java.lang.String generateStrongPassword()-
-
-
- Description copied from interface:
Authenticator
- - Generate a strong password. Implementations should use a large character set that does not
- include confusing characters, such as i I 1 l 0 o and O. There are many algorithms to
- generate strong memorable passwords that have been studied in the past.
-
-
-
-
- Specified by:
generateStrongPasswordin interfaceAuthenticator
-
-
-
- Returns:
- a password with strong password strength
- -
-changePassword
--public void changePassword(User user, - java.lang.String currentPassword, - java.lang.String newPassword, - java.lang.String newPassword2) - throws AuthenticationException-
-
-
- Description copied from interface:
Authenticator
- - Changes the password for the specified user. This requires the current password, as well as
- the password to replace it with. This new password must be repeated to ensure that the user has
- typed it in correctly.
-
-
-
-
- Specified by:
changePasswordin interfaceAuthenticator
-
-
- Parameters:
user- the user to change the password forcurrentPassword- the current password for the specified usernewPassword- the new password to usenewPassword2- a verification copy of the new password -- Throws: -
AuthenticationException- if any errors occur
- -
-verifyPassword
--public boolean verifyPassword(User user, - java.lang.String password)-
-
-
- Description copied from interface:
Authenticator
- - Verify that the supplied password matches the password for this user. This method
- is typically used for "reauthentication" for the most sensitive functions, such
- as transactions, changing email address, and changing other account information.
-
-
-
-
- Specified by:
verifyPasswordin interfaceAuthenticator
-
-
- Parameters:
user- the userpassword- the password -- Returns:
- true, if the password is correct for the specified user
- -
-generateStrongPassword
--public java.lang.String generateStrongPassword(User user, - java.lang.String oldPassword)-
-
-
- Description copied from interface:
Authenticator
- - Generate strong password that takes into account the user's information and old password. Implementations
- should verify that the new password does not include information such as the username, fragments of the
- old password, and other information that could be used to weaken the strength of the password.
-
-
-
-
- Specified by:
generateStrongPasswordin interfaceAuthenticator
-
-
- Parameters:
user- the user whose information to use when generating passwordoldPassword- the old password to use when verifying strength of new password. The new password may be checked for fragments of oldPassword. -- Returns:
- a password with strong password strength
- -
-getCurrentUser
--public User getCurrentUser()-
-
-
- Description copied from interface:
Authenticator
- - Returns the currently logged in User.
-
-
-
-
- Specified by:
getCurrentUserin interfaceAuthenticator
-
-
-
- Returns:
- the matching User object, or the Anonymous user if no match - exists
- -
-getUser
--public User getUser(long accountId)-
-
-
- Gets the user object with the matching account name or null if there is no match.
-
-
-
-
- Specified by:
getUserin interfaceAuthenticator
-
-
- Parameters:
accountId- the account id -- Returns:
- the user, or null if not matched.
- -
-getUser
--public User getUser(java.lang.String accountName)-
-
-
- Gets the user object with the matching account name or null if there is no match.
-
-
-
-
- Specified by:
getUserin interfaceAuthenticator
-
-
- Parameters:
accountName- the account name -- Returns:
- the user, or null if not matched.
- -
-getUserNames
--public java.util.Set getUserNames()-
-
-
- Gets the user names.
-
-
-
-
- Specified by:
getUserNamesin interfaceAuthenticator
-
-
-
- Returns:
- list of user account names
- -
-hashPassword
--public java.lang.String hashPassword(java.lang.String password, - java.lang.String accountName) - throws EncryptionException-
-
-
- Description copied from interface:
Authenticator
- - Returns a string representation of the hashed password, using the
- accountName as the salt. The salt helps to prevent against "rainbow"
- table attacks where the attacker pre-calculates hashes for known strings.
- This method specifies the use of the user's account name as the "salt"
- value. The Encryptor.hash method can be used if a different salt is
- required.
-
-
-
-
- Specified by:
hashPasswordin interfaceAuthenticator
-
-
- Parameters:
password- the password to hashaccountName- the account name to use as the salt -- Returns:
- the hashed password -
- Throws: -
EncryptionException
- -
-removeUser
--public void removeUser(java.lang.String accountName) - throws AuthenticationException-
-
-
- Description copied from interface:
Authenticator
- - Removes the account.
-
-
-
-
- Specified by:
removeUserin interfaceAuthenticator
-
-
- Parameters:
accountName- the account name to remove -- Throws: -
AuthenticationException- the authentication exception if user does not exist
- -
-login
--public User login(javax.servlet.http.HttpServletRequest request, - javax.servlet.http.HttpServletResponse response) - throws AuthenticationException-
-
-
- This method should be called for every HTTP request, to login the current user either from the session of HTTP
- request. This method will set the current user so that getCurrentUser() will work properly. This method also
- checks that the user's access is still enabled, unlocked, and unexpired before allowing login. For convenience
- this method also returns the current user.
-
-
-
-
- Specified by:
loginin interfaceAuthenticator
-
-
- Parameters:
request- the requestresponse- the response -- Returns:
- the user -
- Throws: -
AuthenticationException- the authentication exception
- -
-logout
--public void logout()-
-
-
- Log out the current user.
-
-
-
-
- Specified by:
logoutin interfaceAuthenticator
-
-
- -
-setCurrentUser
--public void setCurrentUser(User user)-
-
-
- Description copied from interface:
Authenticator
- - Sets the currently logged in User.
-
-
-
-
- Specified by:
setCurrentUserin interfaceAuthenticator
-
-
- Parameters:
user- the user to set as the current user
- -
-verifyAccountNameStrength
--public void verifyAccountNameStrength(java.lang.String newAccountName) - throws AuthenticationException-
-
-
- Description copied from interface:
Authenticator
- - Ensures that the account name passes site-specific complexity requirements, like minimum length.
-
-
-
-
- Specified by:
verifyAccountNameStrengthin interfaceAuthenticator
-
-
- Parameters:
newAccountName- the account name -- Throws: -
AuthenticationException- if account name does not meet complexity requirements
- -
-verifyPasswordStrength
--public void verifyPasswordStrength(java.lang.String oldPassword, - java.lang.String newPassword) - throws AuthenticationException-
-
-
- Description copied from interface:
Authenticator
- - Ensures that the password meets site-specific complexity requirements. This
- method takes the old password so that the algorithm can analyze the new password
- to see if it is too similar to the old password. Note that this has to be
- invoked when the user has entered the old password, as the list of old
- credentials stored by ESAPI is all hashed.
-
-
-
-
- Specified by:
verifyPasswordStrengthin interfaceAuthenticator
-
-
- Parameters:
oldPassword- the old passwordnewPassword- the new password -- Returns:
- true, if the new password meets complexity requirements and is not too similar to the old password -
- Throws: -
AuthenticationException- if newPassword is too similar to oldPassword or if newPassword does not meet complexity requirements
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/HTTPUtilitiesTest.html b/javadoc/org/owasp/esapi/reference/HTTPUtilitiesTest.html deleted file mode 100644 index 981ff9b86..000000000 --- a/javadoc/org/owasp/esapi/reference/HTTPUtilitiesTest.html +++ /dev/null @@ -1,554 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class HTTPUtilitiesTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class HTTPUtilitiesTest
- extends junit.framework.TestCase
-The Class HTTPUtilitiesTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
HTTPUtilitiesTest(java.lang.String testName)
-
-- Instantiates a new HTTP utilities test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testAddCSRFToken()
-
-- Test of addCSRFToken method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testChangeSessionIdentifier()
-
-- Test of sendRedirect method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testGetFileUploads()
-
-- Test of formatHttpRequestForLog method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testGetStateFromEncryptedCookie()
-
-- |
-
- void |
-testIsValidHTTPRequest()
-
-- Test of isValidHTTPRequest method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testKillAllCookies()
-
-- Test of killAllCookies method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testKillCookie()
-
-- Test of killCookie method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testSaveStateInEncryptedCookie()
-
-- |
-
- void |
-testSendSafeRedirect()
-
-- Test of sendRedirect method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testSetCookie()
-
-- Test of setCookie method, of class org.owasp.esapi.HTTPUtilities. |
-
- void |
-testSetNoCacheHeaders()
-
-- Test set no cache headers. |
-
- void |
-testSetRememberToken()
-
-- |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-HTTPUtilitiesTest
--public HTTPUtilitiesTest(java.lang.String testName)-
-
-
- Instantiates a new HTTP utilities test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testAddCSRFToken
--public void testAddCSRFToken() - throws AuthenticationException-
-
-
- Test of addCSRFToken method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
-
- Throws: -
AuthenticationException
- -
-testChangeSessionIdentifier
--public void testChangeSessionIdentifier() - throws EnterpriseSecurityException-
-
-
- Test of sendRedirect method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
-
- Throws: -
ValidationException- the validation exception -java.io.IOException- Signals that an I/O exception has occurred. -AuthenticationException- the authentication exception -EnterpriseSecurityException
- -
-testGetFileUploads
--public void testGetFileUploads() - throws java.io.IOException-
-
-
- Test of formatHttpRequestForLog method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
-
- Throws: -
java.io.IOException
- -
-testIsValidHTTPRequest
--public void testIsValidHTTPRequest()-
-
-
- Test of isValidHTTPRequest method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
- -
-testKillAllCookies
--public void testKillAllCookies()-
-
-
- Test of killAllCookies method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
- -
-testKillCookie
--public void testKillCookie()-
-
-
- Test of killCookie method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
- -
-testSendSafeRedirect
--public void testSendSafeRedirect() - throws ValidationException, - java.io.IOException-
-
-
- Test of sendRedirect method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
-
- Throws: -
ValidationException- the validation exception -java.io.IOException- Signals that an I/O exception has occurred.
- -
-testSetCookie
--public void testSetCookie()-
-
-
- Test of setCookie method, of class org.owasp.esapi.HTTPUtilities.
-
-
-
-
- -
-testGetStateFromEncryptedCookie
--public void testGetStateFromEncryptedCookie()-
-
-
-
-
-
- -
-testSaveStateInEncryptedCookie
--public void testSaveStateInEncryptedCookie()-
-
-
-
-
-
- -
-testSetNoCacheHeaders
--public void testSetNoCacheHeaders()-
-
-
- Test set no cache headers.
-
-
-
-
- -
-testSetRememberToken
--public void testSetRememberToken() - throws AuthenticationException-
-
-
-
-
-
- Throws: -
AuthenticationException
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/IntegerAccessReferenceMap.html b/javadoc/org/owasp/esapi/reference/IntegerAccessReferenceMap.html deleted file mode 100644 index cdf09a9c1..000000000 --- a/javadoc/org/owasp/esapi/reference/IntegerAccessReferenceMap.html +++ /dev/null @@ -1,439 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class IntegerAccessReferenceMap
--java.lang.Object --
-
-
- All Implemented Interfaces:
- AccessReferenceMap -
-
-
-
- public class IntegerAccessReferenceMap
- extends java.lang.Object
- implements AccessReferenceMap
- extends java.lang.Object
-Reference implementation of the AccessReferenceMap interface. This - implementation generates integers for indirect references. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
AccessReferenceMap
- -
| -Constructor Summary | -|
IntegerAccessReferenceMap()
-
-- This AccessReferenceMap implementation uses integers to - create a layer of indirection. |
-|
IntegerAccessReferenceMap(java.util.Set directReferences)
-
-- Instantiates a new access reference map. |
-|
| -Method Summary | -|
- java.lang.String |
-addDirectReference(java.lang.Object direct)
-
-- Adds a direct reference and a new indirect reference, overwriting any existing values. |
-
- java.lang.Object |
-getDirectReference(java.lang.String indirectReference)
-
-- Get the original direct object reference from an indirect reference. |
-
- java.lang.String |
-getIndirectReference(java.lang.Object directReference)
-
-- Get a safe indirect reference to use in place of a potentially sensitive - direct object reference. |
-
- java.util.Iterator |
-iterator()
-
-- Get an iterator through the direct object references. |
-
- java.lang.String |
-removeDirectReference(java.lang.Object direct)
-
-- Remove a direct reference and the corresponding indirect reference. |
-
- void |
-update(java.util.Set directReferences)
-
-- This preserves any existing mappings for items that are still in the new - list. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-IntegerAccessReferenceMap
--public IntegerAccessReferenceMap()-
-
-
- This AccessReferenceMap implementation uses integers to
- create a layer of indirection.
-
-
- -
-IntegerAccessReferenceMap
--public IntegerAccessReferenceMap(java.util.Set directReferences)-
-
-
- Instantiates a new access reference map.
-
-
- Parameters:
directReferences- the direct references
| -Method Detail | -
-iterator
--public java.util.Iterator iterator()-
-
-
- Description copied from interface:
AccessReferenceMap
- - Get an iterator through the direct object references. No guarantee is made as
- to the order of items returned.
-
-
-
-
- Specified by:
iteratorin interfaceAccessReferenceMap
-
-
-
- Returns:
- the iterator
- -
-addDirectReference
--public java.lang.String addDirectReference(java.lang.Object direct)-
-
-
- Adds a direct reference and a new indirect reference, overwriting any existing values.
-
-
-
-
- Specified by:
addDirectReferencein interfaceAccessReferenceMap
-
-
- Parameters:
direct- -- Returns:
- the corresponding indirect reference
- -
-removeDirectReference
--public java.lang.String removeDirectReference(java.lang.Object direct) - throws AccessControlException-
-
-
- Remove a direct reference and the corresponding indirect reference.
-
-
-
-
- Specified by:
removeDirectReferencein interfaceAccessReferenceMap
-
-
- Parameters:
direct- -- Returns:
- the corresponding indirect reference -
- Throws: -
AccessControlException
- -
-update
--public final void update(java.util.Set directReferences)-
-
-
- This preserves any existing mappings for items that are still in the new
- list. You could regenerate new indirect references every time, but that
- might mess up anything that previously used an indirect reference, such
- as a URL parameter.
-
-
-
-
- Specified by:
updatein interfaceAccessReferenceMap
-
-
- Parameters:
directReferences- the direct references
- -
-getIndirectReference
--public java.lang.String getIndirectReference(java.lang.Object directReference)-
-
-
- Description copied from interface:
AccessReferenceMap
- - Get a safe indirect reference to use in place of a potentially sensitive
- direct object reference. Developers should use this call when building
- URL's, form fields, hidden fields, etc... to help protect their private
- implementation information.
-
-
-
-
- Specified by:
getIndirectReferencein interfaceAccessReferenceMap
-
-
- Parameters:
directReference- the direct reference -- Returns:
- the indirect reference
- -
-getDirectReference
--public java.lang.Object getDirectReference(java.lang.String indirectReference) - throws AccessControlException-
-
-
- Description copied from interface:
AccessReferenceMap
- - Get the original direct object reference from an indirect reference.
- Developers should use this when they get an indirect reference from a
- request to translate it back into the real direct reference. If an
- invalid indirectReference is requested, then an AccessControlException is
- thrown.
-
-
-
-
- Specified by:
getDirectReferencein interfaceAccessReferenceMap
-
-
- Parameters:
indirectReference- the indirect reference -- Returns:
- the direct reference -
- Throws: -
AccessControlException- if no direct reference exists for the - specified indirect reference
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/IntegerAccessReferenceMapTest.html b/javadoc/org/owasp/esapi/reference/IntegerAccessReferenceMapTest.html deleted file mode 100644 index 6f33dfe6d..000000000 --- a/javadoc/org/owasp/esapi/reference/IntegerAccessReferenceMapTest.html +++ /dev/null @@ -1,428 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class IntegerAccessReferenceMapTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class IntegerAccessReferenceMapTest
- extends junit.framework.TestCase
-The Class AccessReferenceMapTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
IntegerAccessReferenceMapTest(java.lang.String testName)
-
-- Instantiates a new access reference map test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testAddDirectReference()
-
-- |
-
- void |
-testGetDirectReference()
-
-- Test of getDirectReference method, of class - org.owasp.esapi.AccessReferenceMap. |
-
- void |
-testGetIndirectReference()
-
-- Test of getIndirectReference method, of class - org.owasp.esapi.AccessReferenceMap. |
-
- void |
-testIterator()
-
-- Test of iterator method, of class org.owasp.esapi.AccessReferenceMap. |
-
- void |
-testRemoveDirectReference()
-
-- |
-
- void |
-testUpdate()
-
-- Test of update method, of class org.owasp.esapi.AccessReferenceMap. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-IntegerAccessReferenceMapTest
--public IntegerAccessReferenceMapTest(java.lang.String testName)-
-
-
- Instantiates a new access reference map test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testUpdate
--public void testUpdate() - throws AuthenticationException, - EncryptionException-
-
-
- Test of update method, of class org.owasp.esapi.AccessReferenceMap.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception -EncryptionException
- -
-testIterator
--public void testIterator()-
-
-
- Test of iterator method, of class org.owasp.esapi.AccessReferenceMap.
-
-
-
-
- -
-testGetIndirectReference
--public void testGetIndirectReference()-
-
-
- Test of getIndirectReference method, of class
- org.owasp.esapi.AccessReferenceMap.
-
-
-
-
- -
-testGetDirectReference
--public void testGetDirectReference() - throws AccessControlException-
-
-
- Test of getDirectReference method, of class
- org.owasp.esapi.AccessReferenceMap.
-
-
-
-
-
- Throws: -
AccessControlException- the access control exception
- -
-testAddDirectReference
--public void testAddDirectReference() - throws AccessControlException-
-
-
-
-
-
- Throws: -
AccessControlException
-
- -
-testRemoveDirectReference
--public void testRemoveDirectReference() - throws AccessControlException-
-
-
-
-
-
- Throws: -
AccessControlException
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/IntrusionDetectorTest.html b/javadoc/org/owasp/esapi/reference/IntrusionDetectorTest.html deleted file mode 100644 index 305bf2451..000000000 --- a/javadoc/org/owasp/esapi/reference/IntrusionDetectorTest.html +++ /dev/null @@ -1,336 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class IntrusionDetectorTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class IntrusionDetectorTest
- extends junit.framework.TestCase
-The Class IntrusionDetectorTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
IntrusionDetectorTest(java.lang.String testName)
-
-- Instantiates a new intrusion detector test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testAddEvent()
-
-- Test of addEvent method, of class org.owasp.esapi.IntrusionDetector. |
-
- void |
-testAddException()
-
-- Test of addException method, of class org.owasp.esapi.IntrusionDetector. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-IntrusionDetectorTest
--public IntrusionDetectorTest(java.lang.String testName)-
-
-
- Instantiates a new intrusion detector test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testAddException
--public void testAddException() - throws AuthenticationException-
-
-
- Test of addException method, of class org.owasp.esapi.IntrusionDetector.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testAddEvent
--public void testAddEvent() - throws AuthenticationException-
-
-
- Test of addEvent method, of class org.owasp.esapi.IntrusionDetector.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/JSEEncryptor.html b/javadoc/org/owasp/esapi/reference/JSEEncryptor.html deleted file mode 100644 index b381563f2..000000000 --- a/javadoc/org/owasp/esapi/reference/JSEEncryptor.html +++ /dev/null @@ -1,551 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class JSEEncryptor
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Encryptor -
-
-
-
- public class JSEEncryptor
- extends java.lang.Object
- implements Encryptor
- extends java.lang.Object
-Reference implementation of the IEncryptor interface. This implementation - layers on the JCE provided cryptographic package. Algorithms used are - configurable in the ESAPI.properties file. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Encryptor
- -
| -Constructor Summary | -|
JSEEncryptor()
-
-- |
-|
| -Method Summary | -|
- java.lang.String |
-decrypt(java.lang.String ciphertext)
-
-- Decrypts the provided ciphertext string (encrypted with the encrypt - method) and returns a plaintext string. |
-
- java.lang.String |
-encrypt(java.lang.String plaintext)
-
-- Encrypts the provided plaintext and returns a ciphertext string. |
-
- long |
-getRelativeTimeStamp(long offset)
-
-- Gets an absolute timestamp representing an offset from the current time to be used by - other functions in the library. |
-
- long |
-getTimeStamp()
-
-- Gets a timestamp representing the current date and time to be used by - other functions in the library. |
-
- java.lang.String |
-hash(java.lang.String plaintext,
- java.lang.String salt)
-
-- Hashes the data using the specified algorithm and the Java MessageDigest class. |
-
- java.lang.String |
-seal(java.lang.String data,
- long expiration)
-
-- Creates a seal that binds a set of data and includes an expiration timestamp. |
-
- java.lang.String |
-sign(java.lang.String data)
-
-- Create a digital signature for the provided data and return it in a - string. |
-
- java.lang.String |
-unseal(java.lang.String seal)
-
-- Unseals data (created with the seal method) and throws an exception - describing any of the various problems that could exist with a seal, such - as an invalid seal format, expired timestamp, or decryption error. |
-
- boolean |
-verifySeal(java.lang.String seal)
-
-- Verifies a seal (created with the seal method) and throws an exception - describing any of the various problems that could exist with a seal, such - as an invalid seal format, expired timestamp, or data mismatch. |
-
- boolean |
-verifySignature(java.lang.String signature,
- java.lang.String data)
-
-- Verifies a digital signature (created with the sign method) and returns - the boolean result. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-JSEEncryptor
--public JSEEncryptor()-
-
-
| -Method Detail | -
-hash
--public java.lang.String hash(java.lang.String plaintext, - java.lang.String salt) - throws EncryptionException-
-
-
- Hashes the data using the specified algorithm and the Java MessageDigest class. This method
- first adds the salt, a separator (":"), and the data, and then rehashes 1024 times to help strengthen weak passwords.
-
-
- -
--
-
- Parameters:
plaintext- the plaintextsalt- the salt -- Returns:
- the string -
- Throws: -
EncryptionException- the encryption exception- See Also:
Encryptor.hash(java.lang.String,java.lang.String)
- -
-encrypt
--public java.lang.String encrypt(java.lang.String plaintext) - throws EncryptionException-
-
-
- Description copied from interface:
Encryptor
- - Encrypts the provided plaintext and returns a ciphertext string.
-
-
- -
--
-
- Parameters:
plaintext- the plaintext -- Returns:
- the string -
- Throws: -
EncryptionException- the encryption exception
- -
-decrypt
--public java.lang.String decrypt(java.lang.String ciphertext) - throws EncryptionException-
-
-
- Description copied from interface:
Encryptor
- - Decrypts the provided ciphertext string (encrypted with the encrypt
- method) and returns a plaintext string.
-
-
- -
--
-
- Parameters:
ciphertext- the ciphertext -- Returns:
- the string -
- Throws: -
EncryptionException- the encryption exception
- -
-sign
--public java.lang.String sign(java.lang.String data) - throws EncryptionException-
-
-
- Description copied from interface:
Encryptor
- - Create a digital signature for the provided data and return it in a
- string.
-
-
- -
--
-
- Parameters:
data- the data -- Returns:
- the string -
- Throws: -
EncryptionException- the encryption exception
- -
-verifySignature
--public boolean verifySignature(java.lang.String signature, - java.lang.String data)-
-
-
- Description copied from interface:
Encryptor
- - Verifies a digital signature (created with the sign method) and returns
- the boolean result.
-
-
-
-
- Specified by:
verifySignaturein interfaceEncryptor
-
-
- Parameters:
signature- the signaturedata- the data -- Returns:
- true, if successful
- -
-seal
--public java.lang.String seal(java.lang.String data, - long expiration) - throws IntegrityException-
-
-
- Description copied from interface:
Encryptor
- - Creates a seal that binds a set of data and includes an expiration timestamp.
-
-
- -
--
-
- Parameters:
data- the dataexpiration- the absolute expiration date of the data, expressed as seconds since the epoch -- Returns:
- the string -
- Throws: -
IntegrityException
- -
-unseal
--public java.lang.String unseal(java.lang.String seal) - throws EncryptionException-
-
-
- Description copied from interface:
Encryptor
- - Unseals data (created with the seal method) and throws an exception
- describing any of the various problems that could exist with a seal, such
- as an invalid seal format, expired timestamp, or decryption error.
-
-
- -
--
-
- Parameters:
seal- the sealed data -- Returns:
- the original data -
- Throws: -
EncryptionException
- -
-verifySeal
--public boolean verifySeal(java.lang.String seal)-
-
-
- Description copied from interface:
Encryptor
- - Verifies a seal (created with the seal method) and throws an exception
- describing any of the various problems that could exist with a seal, such
- as an invalid seal format, expired timestamp, or data mismatch.
-
-
-
-
- Specified by:
verifySealin interfaceEncryptor
-
-
- Parameters:
seal- the seal -- Returns:
- true if the seal is valid
- -
-getTimeStamp
--public long getTimeStamp()-
-
-
- Description copied from interface:
Encryptor
- - Gets a timestamp representing the current date and time to be used by
- other functions in the library.
-
-
-
-
- Specified by:
getTimeStampin interfaceEncryptor
-
-
-
- Returns:
- the timestamp
- -
-getRelativeTimeStamp
--public long getRelativeTimeStamp(long offset)-
-
-
- Description copied from interface:
Encryptor
- - Gets an absolute timestamp representing an offset from the current time to be used by
- other functions in the library.
-
-
-
-
- Specified by:
getRelativeTimeStampin interfaceEncryptor
-
-
-
- Returns:
- the absolute timestamp
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/JavaEncryptor.html b/javadoc/org/owasp/esapi/reference/JavaEncryptor.html deleted file mode 100644 index 0aa3d5dce..000000000 --- a/javadoc/org/owasp/esapi/reference/JavaEncryptor.html +++ /dev/null @@ -1,551 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class JavaEncryptor
--java.lang.Object --
-
-
- All Implemented Interfaces:
- Encryptor -
-
-
-
- public class JavaEncryptor
- extends java.lang.Object
- implements Encryptor
- extends java.lang.Object
-Reference implementation of the Encryptor interface. This implementation - layers on the JCE provided cryptographic package. Algorithms used are - configurable in the ESAPI.properties file. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Encryptor
- -
| -Constructor Summary | -|
JavaEncryptor()
-
-- |
-|
| -Method Summary | -|
- java.lang.String |
-decrypt(java.lang.String ciphertext)
-
-- Decrypts the provided ciphertext string (encrypted with the encrypt - method) and returns a plaintext string. |
-
- java.lang.String |
-encrypt(java.lang.String plaintext)
-
-- Encrypts the provided plaintext and returns a ciphertext string. |
-
- long |
-getRelativeTimeStamp(long offset)
-
-- Gets an absolute timestamp representing an offset from the current time to be used by - other functions in the library. |
-
- long |
-getTimeStamp()
-
-- Gets a timestamp representing the current date and time to be used by - other functions in the library. |
-
- java.lang.String |
-hash(java.lang.String plaintext,
- java.lang.String salt)
-
-- Hashes the data using the specified algorithm and the Java MessageDigest class. |
-
- java.lang.String |
-seal(java.lang.String data,
- long expiration)
-
-- Creates a seal that binds a set of data and includes an expiration timestamp. |
-
- java.lang.String |
-sign(java.lang.String data)
-
-- Create a digital signature for the provided data and return it in a - string. |
-
- java.lang.String |
-unseal(java.lang.String seal)
-
-- Unseals data (created with the seal method) and throws an exception - describing any of the various problems that could exist with a seal, such - as an invalid seal format, expired timestamp, or decryption error. |
-
- boolean |
-verifySeal(java.lang.String seal)
-
-- Verifies a seal (created with the seal method) and throws an exception - describing any of the various problems that could exist with a seal, such - as an invalid seal format, expired timestamp, or data mismatch. |
-
- boolean |
-verifySignature(java.lang.String signature,
- java.lang.String data)
-
-- Verifies a digital signature (created with the sign method) and returns - the boolean result. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-JavaEncryptor
--public JavaEncryptor()-
-
-
| -Method Detail | -
-hash
--public java.lang.String hash(java.lang.String plaintext, - java.lang.String salt) - throws EncryptionException-
-
-
- Hashes the data using the specified algorithm and the Java MessageDigest class. This method
- first adds the salt, a separator (":"), and the data, and then rehashes 1024 times to help strengthen weak passwords.
-
-
- -
--
-
- Parameters:
plaintext- the plaintext String to encryptsalt- the salt -- Returns:
- the encrypted hash of 'plaintext' stored as a String -
- Throws: -
EncryptionException- the encryption exception- See Also:
Encryptor.hash(java.lang.String,java.lang.String)
- -
-encrypt
--public java.lang.String encrypt(java.lang.String plaintext) - throws EncryptionException-
-
-
- Description copied from interface:
Encryptor
- - Encrypts the provided plaintext and returns a ciphertext string.
-
-
- -
--
-
- Parameters:
plaintext- the plaintext String to encrypt -- Returns:
- the encrypted String -
- Throws: -
EncryptionException- the encryption exception
- -
-decrypt
--public java.lang.String decrypt(java.lang.String ciphertext) - throws EncryptionException-
-
-
- Description copied from interface:
Encryptor
- - Decrypts the provided ciphertext string (encrypted with the encrypt
- method) and returns a plaintext string.
-
-
- -
--
-
- Parameters:
ciphertext- the ciphertext -- Returns:
- the decrypted ciphertext -
- Throws: -
EncryptionException- the encryption exception
- -
-sign
--public java.lang.String sign(java.lang.String data) - throws EncryptionException-
-
-
- Description copied from interface:
Encryptor
- - Create a digital signature for the provided data and return it in a
- string.
-
-
- -
--
-
- Parameters:
data- the data to sign -- Returns:
- the digital signature stored as a String -
- Throws: -
EncryptionException- the encryption exception
- -
-verifySignature
--public boolean verifySignature(java.lang.String signature, - java.lang.String data)-
-
-
- Description copied from interface:
Encryptor
- - Verifies a digital signature (created with the sign method) and returns
- the boolean result.
-
-
-
-
- Specified by:
verifySignaturein interfaceEncryptor
-
-
- Parameters:
signature- the signature to verifydata- the data to verify -- Returns:
- true, if the signature is verified
- -
-seal
--public java.lang.String seal(java.lang.String data, - long expiration) - throws IntegrityException-
-
-
- Description copied from interface:
Encryptor
- - Creates a seal that binds a set of data and includes an expiration timestamp.
-
-
- -
--
-
- Parameters:
data- the data to sealexpiration- the absolute expiration date of the data, expressed as seconds since the epoch -- Returns:
- the seal -
- Throws: -
IntegrityException
- -
-unseal
--public java.lang.String unseal(java.lang.String seal) - throws EncryptionException-
-
-
- Description copied from interface:
Encryptor
- - Unseals data (created with the seal method) and throws an exception
- describing any of the various problems that could exist with a seal, such
- as an invalid seal format, expired timestamp, or decryption error.
-
-
- -
--
-
- Parameters:
seal- the sealed data -- Returns:
- the original data -
- Throws: -
EncryptionException
- -
-verifySeal
--public boolean verifySeal(java.lang.String seal)-
-
-
- Description copied from interface:
Encryptor
- - Verifies a seal (created with the seal method) and throws an exception
- describing any of the various problems that could exist with a seal, such
- as an invalid seal format, expired timestamp, or data mismatch.
-
-
-
-
- Specified by:
verifySealin interfaceEncryptor
-
-
- Parameters:
seal- the seal -- Returns:
- true, if the seal is valid
- -
-getTimeStamp
--public long getTimeStamp()-
-
-
- Description copied from interface:
Encryptor
- - Gets a timestamp representing the current date and time to be used by
- other functions in the library.
-
-
-
-
- Specified by:
getTimeStampin interfaceEncryptor
-
-
-
- Returns:
- the timestamp
- -
-getRelativeTimeStamp
--public long getRelativeTimeStamp(long offset)-
-
-
- Description copied from interface:
Encryptor
- - Gets an absolute timestamp representing an offset from the current time to be used by
- other functions in the library.
-
-
-
-
- Specified by:
getRelativeTimeStampin interfaceEncryptor
-
-
- Parameters:
offset- the offset to add to the current time -- Returns:
- the absolute timestamp
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/JavaLogFactory.html b/javadoc/org/owasp/esapi/reference/JavaLogFactory.html deleted file mode 100644 index 0444b043c..000000000 --- a/javadoc/org/owasp/esapi/reference/JavaLogFactory.html +++ /dev/null @@ -1,291 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class JavaLogFactory
--java.lang.Object --
-
-
- All Implemented Interfaces:
- LogFactory -
-
-
-
- public class JavaLogFactory
- extends java.lang.Object
- implements LogFactory
- extends java.lang.Object
-Reference implementation of the LogFactory and Logger interfaces. This implementation uses the Java logging package, and marks each - log message with the currently logged in user and the word "SECURITY" for security related events. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security -
- See Also:
Logger
- -
| -Constructor Summary | -|
JavaLogFactory(java.lang.String applicationName)
-
-- |
-|
| -Method Summary | -|
- Logger |
-getLogger(java.lang.Class clazz)
-
-- |
-
- Logger |
-getLogger(java.lang.String name)
-
-- |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-JavaLogFactory
--public JavaLogFactory(java.lang.String applicationName)-
-
-
| -Method Detail | -
-getLogger
--public Logger getLogger(java.lang.Class clazz)-
-
-
-
-
- Specified by:
getLoggerin interfaceLogFactory
--
-
-
- -
-getLogger
--public Logger getLogger(java.lang.String name)-
-
-
-
-
- Specified by:
getLoggerin interfaceLogFactory
--
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/LoggerTest.html b/javadoc/org/owasp/esapi/reference/LoggerTest.html deleted file mode 100644 index 19bd11abc..000000000 --- a/javadoc/org/owasp/esapi/reference/LoggerTest.html +++ /dev/null @@ -1,442 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class LoggerTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class LoggerTest
- extends junit.framework.TestCase
-The Class LoggerTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
LoggerTest(java.lang.String testName)
-
-- Instantiates a new logger test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testDebug()
-
-- Test of logDebug method, of class org.owasp.esapi.Logger. |
-
- void |
-testError()
-
-- Test of logError method, of class org.owasp.esapi.Logger. |
-
- void |
-testFatal()
-
-- Test of logCritical method, of class org.owasp.esapi.Logger. |
-
- void |
-testInfo()
-
-- Test of logSuccess method, of class org.owasp.esapi.Logger. |
-
- void |
-testLogHTTPRequest()
-
-- Test of logHTTPRequest method, of class org.owasp.esapi.Logger. |
-
- void |
-testTrace()
-
-- Test of logTrace method, of class org.owasp.esapi.Logger. |
-
- void |
-testWarning()
-
-- Test of logWarning method, of class org.owasp.esapi.Logger. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-LoggerTest
--public LoggerTest(java.lang.String testName)-
-
-
- Instantiates a new logger test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testLogHTTPRequest
--public void testLogHTTPRequest() - throws ValidationException, - java.io.IOException, - AuthenticationException-
-
-
- Test of logHTTPRequest method, of class org.owasp.esapi.Logger.
-
-
-
-
-
- Throws: -
ValidationException- the validation exception -java.io.IOException- Signals that an I/O exception has occurred. -AuthenticationException- the authentication exception
- -
-testInfo
--public void testInfo()-
-
-
- Test of logSuccess method, of class org.owasp.esapi.Logger.
-
-
-
-
- -
-testTrace
--public void testTrace()-
-
-
- Test of logTrace method, of class org.owasp.esapi.Logger.
-
-
-
-
- -
-testDebug
--public void testDebug()-
-
-
- Test of logDebug method, of class org.owasp.esapi.Logger.
-
-
-
-
- -
-testError
--public void testError()-
-
-
- Test of logError method, of class org.owasp.esapi.Logger.
-
-
-
-
- -
-testWarning
--public void testWarning()-
-
-
- Test of logWarning method, of class org.owasp.esapi.Logger.
-
-
-
-
- -
-testFatal
--public void testFatal()-
-
-
- Test of logCritical method, of class org.owasp.esapi.Logger.
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/RandomAccessReferenceMap.html b/javadoc/org/owasp/esapi/reference/RandomAccessReferenceMap.html deleted file mode 100644 index fd1fa3d22..000000000 --- a/javadoc/org/owasp/esapi/reference/RandomAccessReferenceMap.html +++ /dev/null @@ -1,444 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class RandomAccessReferenceMap
--java.lang.Object --
-
-
- All Implemented Interfaces:
- AccessReferenceMap -
-
-
-
- public class RandomAccessReferenceMap
- extends java.lang.Object
- implements AccessReferenceMap
- extends java.lang.Object
-Reference implementation of the AccessReferenceMap interface. This - implementation generates random 6 character alphanumeric strings for indirect - references. It is possible to use simple integers as indirect references, but - the random string approach provides a certain level of protection from CSRF - attacks, because an attacker would have difficulty guessing the indirect - reference. -
- -
-
-
-
- Since: -
- June 1, 2007 -
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- See Also:
AccessReferenceMap
- -
| -Constructor Summary | -|
RandomAccessReferenceMap()
-
-- This AccessReferenceMap implementation uses short random strings to - create a layer of indirection. |
-|
RandomAccessReferenceMap(java.util.Set directReferences)
-
-- Instantiates a new access reference map. |
-|
| -Method Summary | -|
- java.lang.String |
-addDirectReference(java.lang.Object direct)
-
-- Adds a direct reference and a new random indirect reference, overwriting any existing values. |
-
- java.lang.Object |
-getDirectReference(java.lang.String indirectReference)
-
-- Get the original direct object reference from an indirect reference. |
-
- java.lang.String |
-getIndirectReference(java.lang.Object directReference)
-
-- Get a safe indirect reference to use in place of a potentially sensitive - direct object reference. |
-
- java.util.Iterator |
-iterator()
-
-- Get an iterator through the direct object references. |
-
- java.lang.String |
-removeDirectReference(java.lang.Object direct)
-
-- Remove a direct reference and the corresponding indirect reference. |
-
- void |
-update(java.util.Set directReferences)
-
-- This preserves any existing mappings for items that are still in the new - list. |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| -Constructor Detail | -
-RandomAccessReferenceMap
--public RandomAccessReferenceMap()-
-
-
- This AccessReferenceMap implementation uses short random strings to
- create a layer of indirection. Other possible implementations would use
- simple integers as indirect references.
-
-
- -
-RandomAccessReferenceMap
--public RandomAccessReferenceMap(java.util.Set directReferences)-
-
-
- Instantiates a new access reference map.
-
-
- Parameters:
directReferences- the direct references
| -Method Detail | -
-iterator
--public java.util.Iterator iterator()-
-
-
- Description copied from interface:
AccessReferenceMap
- - Get an iterator through the direct object references. No guarantee is made as
- to the order of items returned.
-
-
-
-
- Specified by:
iteratorin interfaceAccessReferenceMap
-
-
-
- Returns:
- the iterator
- -
-addDirectReference
--public java.lang.String addDirectReference(java.lang.Object direct)-
-
-
- Adds a direct reference and a new random indirect reference, overwriting any existing values.
-
-
-
-
- Specified by:
addDirectReferencein interfaceAccessReferenceMap
-
-
- Parameters:
direct- -- Returns:
- the corresponding indirect reference
- -
-removeDirectReference
--public java.lang.String removeDirectReference(java.lang.Object direct) - throws AccessControlException-
-
-
- Remove a direct reference and the corresponding indirect reference.
-
-
-
-
- Specified by:
removeDirectReferencein interfaceAccessReferenceMap
-
-
- Parameters:
direct- -- Returns:
- the corresponding indirect reference -
- Throws: -
AccessControlException
- -
-update
--public final void update(java.util.Set directReferences)-
-
-
- This preserves any existing mappings for items that are still in the new
- list. You could regenerate new indirect references every time, but that
- might mess up anything that previously used an indirect reference, such
- as a URL parameter.
-
-
-
-
- Specified by:
updatein interfaceAccessReferenceMap
-
-
- Parameters:
directReferences- the direct references
- -
-getIndirectReference
--public java.lang.String getIndirectReference(java.lang.Object directReference)-
-
-
- Description copied from interface:
AccessReferenceMap
- - Get a safe indirect reference to use in place of a potentially sensitive
- direct object reference. Developers should use this call when building
- URL's, form fields, hidden fields, etc... to help protect their private
- implementation information.
-
-
-
-
- Specified by:
getIndirectReferencein interfaceAccessReferenceMap
-
-
- Parameters:
directReference- the direct reference -- Returns:
- the indirect reference
- -
-getDirectReference
--public java.lang.Object getDirectReference(java.lang.String indirectReference) - throws AccessControlException-
-
-
- Description copied from interface:
AccessReferenceMap
- - Get the original direct object reference from an indirect reference.
- Developers should use this when they get an indirect reference from a
- request to translate it back into the real direct reference. If an
- invalid indirectReference is requested, then an AccessControlException is
- thrown.
-
-
-
-
- Specified by:
getDirectReferencein interfaceAccessReferenceMap
-
-
- Parameters:
indirectReference- the indirect reference -- Returns:
- the direct reference -
- Throws: -
AccessControlException- if no direct reference exists for the - specified indirect reference
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/RandomizerTest.html b/javadoc/org/owasp/esapi/reference/RandomizerTest.html deleted file mode 100644 index 05386470c..000000000 --- a/javadoc/org/owasp/esapi/reference/RandomizerTest.html +++ /dev/null @@ -1,375 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class RandomizerTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class RandomizerTest
- extends junit.framework.TestCase
-The Class RandomizerTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
RandomizerTest(java.lang.String testName)
-
-- Instantiates a new randomizer test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testGetRandomGUID()
-
-- Test of getRandomGUID method, of class org.owasp.esapi.Randomizer. |
-
- void |
-testGetRandomInteger()
-
-- Test of getRandomInteger method, of class org.owasp.esapi.Randomizer. |
-
- void |
-testGetRandomReal()
-
-- Test of getRandomReal method, of class org.owasp.esapi.Randomizer. |
-
- void |
-testGetRandomString()
-
-- Test of getRandomString method, of class org.owasp.esapi.Randomizer. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-RandomizerTest
--public RandomizerTest(java.lang.String testName)-
-
-
- Instantiates a new randomizer test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testGetRandomString
--public void testGetRandomString()-
-
-
- Test of getRandomString method, of class org.owasp.esapi.Randomizer.
-
-
-
-
- -
-testGetRandomInteger
--public void testGetRandomInteger()-
-
-
- Test of getRandomInteger method, of class org.owasp.esapi.Randomizer.
-
-
-
-
- -
-testGetRandomReal
--public void testGetRandomReal()-
-
-
- Test of getRandomReal method, of class org.owasp.esapi.Randomizer.
-
-
-
-
- -
-testGetRandomGUID
--public void testGetRandomGUID() - throws EncryptionException-
-
-
- Test of getRandomGUID method, of class org.owasp.esapi.Randomizer.
-
-
-
-
-
- Throws: -
EncryptionException
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/SafeFileTest.html b/javadoc/org/owasp/esapi/reference/SafeFileTest.html deleted file mode 100644 index 98c96b9af..000000000 --- a/javadoc/org/owasp/esapi/reference/SafeFileTest.html +++ /dev/null @@ -1,495 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class SafeFileTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class SafeFileTest
- extends junit.framework.TestCase
-The Class ExecutorTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
SafeFileTest(java.lang.String testName)
-
-- Instantiates a new executor test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testAlternateDataStream()
-
-- |
-
- void |
-testCreateSafeFile()
-
-- Test of executeOSCommand method, of class org.owasp.esapi.Executor |
-
- void |
-testCreateSafeFileParentConstructor()
-
-- |
-
- void |
-testCreateSafeFileURIConstructor()
-
-- |
-
- void |
-testJavaDirInjection()
-
-- |
-
- void |
-testJavaFileInjection()
-
-- |
-
- void |
-testMultipleJavaFileInjection()
-
-- |
-
- void |
-testNormalPercentEncodedFileInjection()
-
-- |
-
- void |
-testWeirdPercentEncodedFileInjection()
-
-- |
-
-static java.lang.String |
-toHex(byte b)
-
-- |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-SafeFileTest
--public SafeFileTest(java.lang.String testName)-
-
-
- Instantiates a new executor test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testJavaFileInjection
--public void testJavaFileInjection()-
-
-
-
-
-
- -
-testMultipleJavaFileInjection
--public void testMultipleJavaFileInjection()-
-
-
-
-
-
- -
-testAlternateDataStream
--public void testAlternateDataStream()-
-
-
-
-
-
- -
-testJavaDirInjection
--public void testJavaDirInjection()-
-
-
-
-
-
- -
-toHex
--public static java.lang.String toHex(byte b)-
-
-
-
-
-
- -
-testNormalPercentEncodedFileInjection
--public void testNormalPercentEncodedFileInjection() - throws java.lang.Exception-
-
-
-
-
-
- Throws: -
java.lang.Exception
-
- -
-testWeirdPercentEncodedFileInjection
--public void testWeirdPercentEncodedFileInjection() - throws java.lang.Exception-
-
-
-
-
-
- Throws: -
java.lang.Exception
-
- -
-testCreateSafeFile
--public void testCreateSafeFile() - throws java.lang.Exception-
-
-
- Test of executeOSCommand method, of class org.owasp.esapi.Executor
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testCreateSafeFileParentConstructor
--public void testCreateSafeFileParentConstructor() - throws java.lang.Exception-
-
-
-
-
-
- Throws: -
java.lang.Exception
-
- -
-testCreateSafeFileURIConstructor
--public void testCreateSafeFileURIConstructor() - throws java.lang.Exception-
-
-
-
-
-
- Throws: -
java.lang.Exception
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/UserTest.html b/javadoc/org/owasp/esapi/reference/UserTest.html deleted file mode 100644 index 336f2f556..000000000 --- a/javadoc/org/owasp/esapi/reference/UserTest.html +++ /dev/null @@ -1,966 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class UserTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class UserTest
- extends junit.framework.TestCase
-The Class UserTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
UserTest(java.lang.String testName)
-
-- Instantiates a new user test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testAddRole()
-
-- Test of testAddRole method, of class org.owasp.esapi.User. |
-
- void |
-testAddRoles()
-
-- Test of addRoles method, of class org.owasp.esapi.User. |
-
- void |
-testChangePassword()
-
-- Test of changePassword method, of class org.owasp.esapi.User. |
-
- void |
-testDisable()
-
-- Test of disable method, of class org.owasp.esapi.User. |
-
- void |
-testEnable()
-
-- Test of enable method, of class org.owasp.esapi.User. |
-
- void |
-testFailedLoginLockout()
-
-- Test of failedLoginCount lockout, of class org.owasp.esapi.User. |
-
- void |
-testGetAccountName()
-
-- Test of getAccountName method, of class org.owasp.esapi.User. |
-
- void |
-testGetLastFailedLoginTime()
-
-- Test get last failed login time. |
-
- void |
-testGetLastLoginTime()
-
-- Test get last login time. |
-
- void |
-testGetLastPasswordChangeTime()
-
-- Test of getLastPasswordChangeTime method, of class org.owasp.esapi.User. |
-
- void |
-testGetRoles()
-
-- Test of getRoles method, of class org.owasp.esapi.User. |
-
- void |
-testGetScreenName()
-
-- Test of xxx method, of class org.owasp.esapi.User. |
-
- void |
-testIncrementFailedLoginCount()
-
-- Test of incrementFailedLoginCount method, of class org.owasp.esapi.User. |
-
- void |
-testIsEnabled()
-
-- Test of isEnabled method, of class org.owasp.esapi.User. |
-
- void |
-testIsInRole()
-
-- Test of isInRole method, of class org.owasp.esapi.User. |
-
- void |
-testIsLocked()
-
-- Test of xxx method, of class org.owasp.esapi.User. |
-
- void |
-testIsSessionAbsoluteTimeout()
-
-- Test of isSessionAbsoluteTimeout method, of class - org.owasp.esapi.IntrusionDetector. |
-
- void |
-testIsSessionTimeout()
-
-- Test of isSessionTimeout method, of class - org.owasp.esapi.IntrusionDetector. |
-
- void |
-testLock()
-
-- Test of lockAccount method, of class org.owasp.esapi.User. |
-
- void |
-testLoginWithPassword()
-
-- Test of loginWithPassword method, of class org.owasp.esapi.User. |
-
- void |
-testLogout()
-
-- Test of logout method, of class org.owasp.esapi.User. |
-
- void |
-testRemoveRole()
-
-- Test of testRemoveRole method, of class org.owasp.esapi.User. |
-
- void |
-testResetCSRFToken()
-
-- Test of testResetCSRFToken method, of class org.owasp.esapi.User. |
-
- void |
-testSetAccountName()
-
-- Test of setAccountName method, of class org.owasp.esapi.User. |
-
- void |
-testSetExpirationTime()
-
-- Test of setExpirationTime method, of class org.owasp.esapi.User. |
-
- void |
-testSetRoles()
-
-- Test of setRoles method, of class org.owasp.esapi.User. |
-
- void |
-testSetScreenName()
-
-- Test of setScreenName method, of class org.owasp.esapi.User. |
-
- void |
-testUnlock()
-
-- Test of unlockAccount method, of class org.owasp.esapi.User. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-UserTest
--public UserTest(java.lang.String testName)-
-
-
- Instantiates a new user test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testAddRole
--public void testAddRole() - throws java.lang.Exception-
-
-
- Test of testAddRole method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testAddRoles
--public void testAddRoles() - throws AuthenticationException-
-
-
- Test of addRoles method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testChangePassword
--public void testChangePassword() - throws java.lang.Exception-
-
-
- Test of changePassword method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testDisable
--public void testDisable() - throws AuthenticationException-
-
-
- Test of disable method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testEnable
--public void testEnable() - throws AuthenticationException-
-
-
- Test of enable method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testFailedLoginLockout
--public void testFailedLoginLockout() - throws AuthenticationException, - EncryptionException-
-
-
- Test of failedLoginCount lockout, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception -EncryptionException
- -
-testGetAccountName
--public void testGetAccountName() - throws AuthenticationException-
-
-
- Test of getAccountName method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testGetLastFailedLoginTime
--public void testGetLastFailedLoginTime() - throws java.lang.Exception-
-
-
- Test get last failed login time.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testGetLastLoginTime
--public void testGetLastLoginTime() - throws java.lang.Exception-
-
-
- Test get last login time.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testGetLastPasswordChangeTime
--public void testGetLastPasswordChangeTime() - throws java.lang.Exception-
-
-
- Test of getLastPasswordChangeTime method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
java.lang.Exception- the exception
- -
-testGetRoles
--public void testGetRoles() - throws java.lang.Exception-
-
-
- Test of getRoles method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testGetScreenName
--public void testGetScreenName() - throws AuthenticationException-
-
-
- Test of xxx method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testIncrementFailedLoginCount
--public void testIncrementFailedLoginCount() - throws AuthenticationException-
-
-
- Test of incrementFailedLoginCount method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testIsEnabled
--public void testIsEnabled() - throws AuthenticationException-
-
-
- Test of isEnabled method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testIsInRole
--public void testIsInRole() - throws AuthenticationException-
-
-
- Test of isInRole method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testIsLocked
--public void testIsLocked() - throws AuthenticationException-
-
-
- Test of xxx method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testIsSessionAbsoluteTimeout
--public void testIsSessionAbsoluteTimeout() - throws AuthenticationException-
-
-
- Test of isSessionAbsoluteTimeout method, of class
- org.owasp.esapi.IntrusionDetector.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testIsSessionTimeout
--public void testIsSessionTimeout() - throws AuthenticationException-
-
-
- Test of isSessionTimeout method, of class
- org.owasp.esapi.IntrusionDetector.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testLock
--public void testLock() - throws AuthenticationException-
-
-
- Test of lockAccount method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testLoginWithPassword
--public void testLoginWithPassword() - throws AuthenticationException-
-
-
- Test of loginWithPassword method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testLogout
--public void testLogout() - throws AuthenticationException-
-
-
- Test of logout method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testRemoveRole
--public void testRemoveRole() - throws AuthenticationException-
-
-
- Test of testRemoveRole method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testResetCSRFToken
--public void testResetCSRFToken() - throws AuthenticationException-
-
-
- Test of testResetCSRFToken method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testSetAccountName
--public void testSetAccountName() - throws AuthenticationException-
-
-
- Test of setAccountName method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException
- -
-testSetExpirationTime
--public void testSetExpirationTime() - throws java.lang.Exception-
-
-
- Test of setExpirationTime method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testSetRoles
--public void testSetRoles() - throws AuthenticationException-
-
-
- Test of setRoles method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testSetScreenName
--public void testSetScreenName() - throws AuthenticationException-
-
-
- Test of setScreenName method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- -
-testUnlock
--public void testUnlock() - throws AuthenticationException-
-
-
- Test of unlockAccount method, of class org.owasp.esapi.User.
-
-
-
-
-
- Throws: -
AuthenticationException- the authentication exception
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/ValidatorTest.html b/javadoc/org/owasp/esapi/reference/ValidatorTest.html deleted file mode 100644 index 66d5ca136..000000000 --- a/javadoc/org/owasp/esapi/reference/ValidatorTest.html +++ /dev/null @@ -1,605 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.reference
-
-Class ValidatorTest
--java.lang.Object --
-
-
- All Implemented Interfaces:
- junit.framework.Test -
-
-
-
- public class ValidatorTest
- extends junit.framework.TestCase
-The Class ValidatorTest. -
- -
-
-
-
- Author: -
- Jeff Williams (jeff.williams@aspectsecurity.com) -
- -
| -Constructor Summary | -|
ValidatorTest(java.lang.String testName)
-
-- Instantiates a new validator test. |
-|
| -Method Summary | -|
-static junit.framework.Test |
-suite()
-
-- Suite. |
-
- void |
-testGetValidDate()
-
-- Test of getValidDate method, of class org.owasp.esapi.Validator. |
-
- void |
-testGetValidSafeHTML()
-
-- Test of getValidSafeHTML method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidCreditCard()
-
-- Test of isValidCreditCard method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidDirectoryPath()
-
-- Test of isValidDirectoryPath method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidFileContent()
-
-- Test of isValidFileContent method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidFileName()
-
-- Test of isValidFileName method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidFileUpload()
-
-- Test of isValidFileUpload method, of class org.owasp.esapi.Validator. |
-
- void |
-testisValidInput()
-
-- Test of isValidEmailAddress method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidInteger()
-
-- |
-
- void |
-testIsValidListItem()
-
-- Test of isValidListItem method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidNumber()
-
-- Test of isValidNumber method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidParameterSet()
-
-- Test of isValidParameterSet method, of class org.owasp.esapi.Validator. |
-
- void |
-testIsValidPrintable()
-
-- |
-
- void |
-testIsValidSafeHTML()
-
-- Test of isValidSafeHTML method, of class org.owasp.esapi.Validator. |
-
- void |
-testSafeReadLine()
-
-- Test safe read line. |
-
| Methods inherited from class junit.framework.TestCase | -
countTestCases, getName, run, run, runBare, setName, toString |
-
| Methods inherited from class junit.framework.Assert | -
assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertEquals, assertFalse, assertFalse, assertNotNull, assertNotNull, assertNotSame, assertNotSame, assertNull, assertNull, assertSame, assertSame, assertTrue, assertTrue, fail, fail, failNotEquals, failNotSame, failSame |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, wait, wait, wait |
-
| -Constructor Detail | -
-ValidatorTest
--public ValidatorTest(java.lang.String testName)-
-
-
- Instantiates a new validator test.
-
-
- Parameters:
testName- the test name
| -Method Detail | -
-suite
--public static junit.framework.Test suite()-
-
-
- Suite.
-
-
-
-
-
- Returns:
- the test
- -
-testIsValidCreditCard
--public void testIsValidCreditCard()-
-
-
- Test of isValidCreditCard method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testisValidInput
--public void testisValidInput()-
-
-
- Test of isValidEmailAddress method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidSafeHTML
--public void testIsValidSafeHTML()-
-
-
- Test of isValidSafeHTML method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testGetValidSafeHTML
--public void testGetValidSafeHTML() - throws java.lang.Exception-
-
-
- Test of getValidSafeHTML method, of class org.owasp.esapi.Validator.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testIsValidListItem
--public void testIsValidListItem()-
-
-
- Test of isValidListItem method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidNumber
--public void testIsValidNumber()-
-
-
- Test of isValidNumber method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidInteger
--public void testIsValidInteger()-
-
-
-
-
-
- -
-testGetValidDate
--public void testGetValidDate() - throws java.lang.Exception-
-
-
- Test of getValidDate method, of class org.owasp.esapi.Validator.
-
-
-
-
-
- Throws: -
java.lang.Exception
- -
-testIsValidFileName
--public void testIsValidFileName()-
-
-
- Test of isValidFileName method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidDirectoryPath
--public void testIsValidDirectoryPath()-
-
-
- Test of isValidDirectoryPath method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidPrintable
--public void testIsValidPrintable()-
-
-
-
-
-
- -
-testIsValidFileContent
--public void testIsValidFileContent()-
-
-
- Test of isValidFileContent method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidFileUpload
--public void testIsValidFileUpload()-
-
-
- Test of isValidFileUpload method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testIsValidParameterSet
--public void testIsValidParameterSet()-
-
-
- Test of isValidParameterSet method, of class org.owasp.esapi.Validator.
-
-
-
-
- -
-testSafeReadLine
--public void testSafeReadLine()-
-
-
- Test safe read line.
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/AccessControllerTest.html b/javadoc/org/owasp/esapi/reference/class-use/AccessControllerTest.html deleted file mode 100644 index d2f775357..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/AccessControllerTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.AccessControllerTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/AccessReferenceMapTest.html b/javadoc/org/owasp/esapi/reference/class-use/AccessReferenceMapTest.html deleted file mode 100644 index 43526285e..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/AccessReferenceMapTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.AccessReferenceMapTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/AuthenticatorTest.html b/javadoc/org/owasp/esapi/reference/class-use/AuthenticatorTest.html deleted file mode 100644 index 7613628a8..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/AuthenticatorTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.AuthenticatorTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/DefaultEncoder.html b/javadoc/org/owasp/esapi/reference/class-use/DefaultEncoder.html deleted file mode 100644 index 27428afc3..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/DefaultEncoder.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.DefaultEncoder
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/DefaultEncryptedProperties.html b/javadoc/org/owasp/esapi/reference/class-use/DefaultEncryptedProperties.html deleted file mode 100644 index b450a53fb..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/DefaultEncryptedProperties.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.DefaultEncryptedProperties
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/DefaultExecutor.html b/javadoc/org/owasp/esapi/reference/class-use/DefaultExecutor.html deleted file mode 100644 index cc42e8c79..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/DefaultExecutor.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.DefaultExecutor
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/DefaultHTTPUtilities.html b/javadoc/org/owasp/esapi/reference/class-use/DefaultHTTPUtilities.html deleted file mode 100644 index b34e7f83a..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/DefaultHTTPUtilities.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.DefaultHTTPUtilities
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/DefaultIntrusionDetector.html b/javadoc/org/owasp/esapi/reference/class-use/DefaultIntrusionDetector.html deleted file mode 100644 index 0db44f654..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/DefaultIntrusionDetector.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.DefaultIntrusionDetector
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/DefaultRandomizer.html b/javadoc/org/owasp/esapi/reference/class-use/DefaultRandomizer.html deleted file mode 100644 index 8324bde54..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/DefaultRandomizer.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.DefaultRandomizer
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/DefaultSafeFile.html b/javadoc/org/owasp/esapi/reference/class-use/DefaultSafeFile.html deleted file mode 100644 index 4b57b4106..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/DefaultSafeFile.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.DefaultSafeFile
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/DefaultSecurityConfiguration.html b/javadoc/org/owasp/esapi/reference/class-use/DefaultSecurityConfiguration.html deleted file mode 100644 index 74a56bfa4..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/DefaultSecurityConfiguration.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.DefaultSecurityConfiguration
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/DefaultUser.html b/javadoc/org/owasp/esapi/reference/class-use/DefaultUser.html deleted file mode 100644 index 7500b1e65..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/DefaultUser.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.DefaultUser
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/DefaultValidator.html b/javadoc/org/owasp/esapi/reference/class-use/DefaultValidator.html deleted file mode 100644 index badd7f65d..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/DefaultValidator.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.DefaultValidator
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/EncoderTest.html b/javadoc/org/owasp/esapi/reference/class-use/EncoderTest.html deleted file mode 100644 index af038455a..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/EncoderTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.EncoderTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/EncryptedPropertiesTest.html b/javadoc/org/owasp/esapi/reference/class-use/EncryptedPropertiesTest.html deleted file mode 100644 index 70b106cb3..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/EncryptedPropertiesTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.EncryptedPropertiesTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/EncryptorTest.html b/javadoc/org/owasp/esapi/reference/class-use/EncryptorTest.html deleted file mode 100644 index 4d49cc6e7..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/EncryptorTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.EncryptorTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/ExecutorTest.html b/javadoc/org/owasp/esapi/reference/class-use/ExecutorTest.html deleted file mode 100644 index 92f4b6a0f..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/ExecutorTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.ExecutorTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/FileBasedAccessController.html b/javadoc/org/owasp/esapi/reference/class-use/FileBasedAccessController.html deleted file mode 100644 index b77c80979..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/FileBasedAccessController.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.FileBasedAccessController
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/FileBasedAuthenticator.html b/javadoc/org/owasp/esapi/reference/class-use/FileBasedAuthenticator.html deleted file mode 100644 index f7d267e6d..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/FileBasedAuthenticator.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.FileBasedAuthenticator
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/HTTPUtilitiesTest.html b/javadoc/org/owasp/esapi/reference/class-use/HTTPUtilitiesTest.html deleted file mode 100644 index 522cf2f6f..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/HTTPUtilitiesTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.HTTPUtilitiesTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/IntegerAccessReferenceMap.html b/javadoc/org/owasp/esapi/reference/class-use/IntegerAccessReferenceMap.html deleted file mode 100644 index 25bd88534..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/IntegerAccessReferenceMap.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.IntegerAccessReferenceMap
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/IntegerAccessReferenceMapTest.html b/javadoc/org/owasp/esapi/reference/class-use/IntegerAccessReferenceMapTest.html deleted file mode 100644 index acb7aedb1..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/IntegerAccessReferenceMapTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.IntegerAccessReferenceMapTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/IntrusionDetectorTest.html b/javadoc/org/owasp/esapi/reference/class-use/IntrusionDetectorTest.html deleted file mode 100644 index 50f267679..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/IntrusionDetectorTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.IntrusionDetectorTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/JSEEncryptor.html b/javadoc/org/owasp/esapi/reference/class-use/JSEEncryptor.html deleted file mode 100644 index 1fd9a8b47..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/JSEEncryptor.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.JSEEncryptor
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/JavaEncryptor.html b/javadoc/org/owasp/esapi/reference/class-use/JavaEncryptor.html deleted file mode 100644 index 38a94ad31..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/JavaEncryptor.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.JavaEncryptor
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/JavaLogFactory.html b/javadoc/org/owasp/esapi/reference/class-use/JavaLogFactory.html deleted file mode 100644 index bc4790919..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/JavaLogFactory.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.JavaLogFactory
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/LoggerTest.html b/javadoc/org/owasp/esapi/reference/class-use/LoggerTest.html deleted file mode 100644 index ef45f8831..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/LoggerTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.LoggerTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/RandomAccessReferenceMap.html b/javadoc/org/owasp/esapi/reference/class-use/RandomAccessReferenceMap.html deleted file mode 100644 index 04ef3984b..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/RandomAccessReferenceMap.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.RandomAccessReferenceMap
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/RandomizerTest.html b/javadoc/org/owasp/esapi/reference/class-use/RandomizerTest.html deleted file mode 100644 index 9328ebcac..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/RandomizerTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.RandomizerTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/SafeFileTest.html b/javadoc/org/owasp/esapi/reference/class-use/SafeFileTest.html deleted file mode 100644 index 57acaf38a..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/SafeFileTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.SafeFileTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/UserTest.html b/javadoc/org/owasp/esapi/reference/class-use/UserTest.html deleted file mode 100644 index d8c171ed6..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/UserTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.UserTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/class-use/ValidatorTest.html b/javadoc/org/owasp/esapi/reference/class-use/ValidatorTest.html deleted file mode 100644 index 5e7f99906..000000000 --- a/javadoc/org/owasp/esapi/reference/class-use/ValidatorTest.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.reference.ValidatorTest
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/package-frame.html b/javadoc/org/owasp/esapi/reference/package-frame.html deleted file mode 100644 index c83a6697a..000000000 --- a/javadoc/org/owasp/esapi/reference/package-frame.html +++ /dev/null @@ -1,90 +0,0 @@ - - - - - -
|
-Classes
-
- -AccessControllerTest - -AccessReferenceMapTest - -AuthenticatorTest - -DefaultEncoder - -DefaultEncryptedProperties - -DefaultExecutor - -DefaultHTTPUtilities - -DefaultIntrusionDetector - -DefaultRandomizer - -DefaultSecurityConfiguration - -DefaultUser - -DefaultValidator - -EncoderTest - -EncryptedPropertiesTest - -EncryptorTest - -ExecutorTest - -FileBasedAccessController - -FileBasedAuthenticator - -HTTPUtilitiesTest - -IntegerAccessReferenceMap - -IntegerAccessReferenceMapTest - -IntrusionDetectorTest - -JavaEncryptor - -JavaLogFactory - -LoggerTest - -RandomAccessReferenceMap - -RandomizerTest - -SafeFileTest - -UserTest - -ValidatorTest |
-
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Package org.owasp.esapi.reference -
-This package contains reference implementations of the ESAPI interfaces. -
-See:
-
- Description
-
- -
| -Class Summary | -|
| AccessControllerTest | -The Class AccessControllerTest. | -
| AccessReferenceMapTest | -The Class AccessReferenceMapTest. | -
| AuthenticatorTest | -The Class AuthenticatorTest. | -
| DefaultEncoder | -Reference implementation of the Encoder interface. | -
| DefaultEncryptedProperties | -Reference implementation of the EncryptedProperties interface. | -
| DefaultExecutor | -Reference implementation of the Executor interface. | -
| DefaultHTTPUtilities | -Reference implementation of the HTTPUtilities interface. | -
| DefaultIntrusionDetector | -Reference implementation of the IntrusionDetector interface. | -
| DefaultRandomizer | -Reference implementation of the Randomizer interface. | -
| DefaultSecurityConfiguration | -The SecurityConfiguration manages all the settings used by the ESAPI in a single place. | -
| DefaultUser | -Reference implementation of the User interface. | -
| DefaultValidator | -Reference implementation of the Validator interface. | -
| EncoderTest | -The Class EncoderTest. | -
| EncryptedPropertiesTest | -The Class EncryptedPropertiesTest. | -
| EncryptorTest | -The Class EncryptorTest. | -
| ExecutorTest | -The Class ExecutorTest. | -
| FileBasedAccessController | -Reference implementation of the AccessController interface. | -
| FileBasedAuthenticator | -Reference implementation of the Authenticator interface. | -
| HTTPUtilitiesTest | -The Class HTTPUtilitiesTest. | -
| IntegerAccessReferenceMap | -Reference implementation of the AccessReferenceMap interface. | -
| IntegerAccessReferenceMapTest | -The Class AccessReferenceMapTest. | -
| IntrusionDetectorTest | -The Class IntrusionDetectorTest. | -
| JavaEncryptor | -Reference implementation of the Encryptor interface. | -
| JavaLogFactory | -Reference implementation of the LogFactory and Logger interfaces. | -
| LoggerTest | -The Class LoggerTest. | -
| RandomAccessReferenceMap | -Reference implementation of the AccessReferenceMap interface. | -
| RandomizerTest | -The Class RandomizerTest. | -
| SafeFileTest | -The Class ExecutorTest. | -
| UserTest | -The Class UserTest. | -
| ValidatorTest | -The Class ValidatorTest. | -
-Package org.owasp.esapi.reference Description -
- --This package contains reference implementations of the ESAPI interfaces. These are intended to -serve as examples of how your enterprise might implement these functions. The reference implementations -are high quality and pass all of the ESAPI test cases. Many of the reference implementations are -likely to be useful in your enterprise without change (Validator, Encoder, Encryptor, etc...). -Implementing other classes (Authenticator, User, AccessController, Logger, etc...) will likely need to -be customized for your enterprise, to integrate with your backend systems and policies. -
- -
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/package-tree.html b/javadoc/org/owasp/esapi/reference/package-tree.html deleted file mode 100644 index 6f5f5cf5e..000000000 --- a/javadoc/org/owasp/esapi/reference/package-tree.html +++ /dev/null @@ -1,165 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Hierarchy For Package org.owasp.esapi.reference -
--
-
- Package Hierarchies:
- All Packages
-
-Class Hierarchy -
--
-
- class java.lang.Object
-
-
- class junit.framework.Assert
-
-
- class junit.framework.TestCase (implements junit.framework.Test)
-
-
-
- class org.owasp.esapi.reference.AccessControllerTest
- class org.owasp.esapi.reference.AccessReferenceMapTest
- class org.owasp.esapi.reference.AuthenticatorTest
- class org.owasp.esapi.reference.EncoderTest
- class org.owasp.esapi.reference.EncryptedPropertiesTest
- class org.owasp.esapi.reference.EncryptorTest
- class org.owasp.esapi.reference.ExecutorTest
- class org.owasp.esapi.reference.HTTPUtilitiesTest
- class org.owasp.esapi.reference.IntegerAccessReferenceMapTest
- class org.owasp.esapi.reference.IntrusionDetectorTest
- class org.owasp.esapi.reference.LoggerTest
- class org.owasp.esapi.reference.RandomizerTest
- class org.owasp.esapi.reference.SafeFileTest
- class org.owasp.esapi.reference.UserTest
- class org.owasp.esapi.reference.ValidatorTest
- class junit.framework.TestCase (implements junit.framework.Test)
-
- class org.owasp.esapi.reference.DefaultEncoder (implements org.owasp.esapi.Encoder) -
- class org.owasp.esapi.reference.DefaultEncryptedProperties (implements org.owasp.esapi.EncryptedProperties) -
- class org.owasp.esapi.reference.DefaultExecutor (implements org.owasp.esapi.Executor) -
- class org.owasp.esapi.reference.DefaultHTTPUtilities (implements org.owasp.esapi.HTTPUtilities) -
- class org.owasp.esapi.reference.DefaultIntrusionDetector (implements org.owasp.esapi.IntrusionDetector) -
- class org.owasp.esapi.reference.DefaultRandomizer (implements org.owasp.esapi.Randomizer) -
- class org.owasp.esapi.reference.DefaultSecurityConfiguration (implements org.owasp.esapi.SecurityConfiguration) -
- class org.owasp.esapi.reference.DefaultUser (implements java.io.Serializable, org.owasp.esapi.User) -
- class org.owasp.esapi.reference.DefaultValidator (implements org.owasp.esapi.Validator) -
- class org.owasp.esapi.reference.FileBasedAccessController (implements org.owasp.esapi.AccessController) -
- class org.owasp.esapi.reference.FileBasedAuthenticator (implements org.owasp.esapi.Authenticator) -
- class org.owasp.esapi.reference.IntegerAccessReferenceMap (implements org.owasp.esapi.AccessReferenceMap) -
- class org.owasp.esapi.reference.JavaEncryptor (implements org.owasp.esapi.Encryptor) -
- class org.owasp.esapi.reference.JavaLogFactory (implements org.owasp.esapi.LogFactory) -
- class org.owasp.esapi.reference.RandomAccessReferenceMap (implements org.owasp.esapi.AccessReferenceMap) -
- class junit.framework.Assert
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/reference/package-use.html b/javadoc/org/owasp/esapi/reference/package-use.html deleted file mode 100644 index e2a621f73..000000000 --- a/javadoc/org/owasp/esapi/reference/package-use.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Package
org.owasp.esapi.reference
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/tags/EncodeForHTMLAttributeTag.html b/javadoc/org/owasp/esapi/tags/EncodeForHTMLAttributeTag.html deleted file mode 100644 index 193d8f987..000000000 --- a/javadoc/org/owasp/esapi/tags/EncodeForHTMLAttributeTag.html +++ /dev/null @@ -1,380 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.tags
-
-Class EncodeForHTMLAttributeTag
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.jsp.tagext.BodyTag, javax.servlet.jsp.tagext.IterationTag, javax.servlet.jsp.tagext.JspTag, java.io.Serializable, javax.servlet.jsp.tagext.Tag -
-
-
-
- public class EncodeForHTMLAttributeTag
- extends javax.servlet.jsp.tagext.BodyTagSupport
-
-
-
- See Also:
- Serialized Form
- -
| -Field Summary | -
| Fields inherited from interface javax.servlet.jsp.tagext.BodyTag | -
EVAL_BODY_BUFFERED, EVAL_BODY_TAG |
-
| Fields inherited from interface javax.servlet.jsp.tagext.IterationTag | -
EVAL_BODY_AGAIN |
-
| Fields inherited from interface javax.servlet.jsp.tagext.Tag | -
EVAL_BODY_INCLUDE, EVAL_PAGE, SKIP_BODY, SKIP_PAGE |
-
| -Constructor Summary | -|
EncodeForHTMLAttributeTag()
-
-- |
-|
| -Method Summary | -|
- int |
-doAfterBody()
-
-- |
-
- int |
-doStartTag()
-
-- |
-
- java.lang.String |
-getName()
-
-- |
-
- void |
-setName(java.lang.String name)
-
-- |
-
| Methods inherited from class javax.servlet.jsp.tagext.BodyTagSupport | -
doEndTag, doInitBody, getBodyContent, getPreviousOut, release, setBodyContent |
-
| Methods inherited from class javax.servlet.jsp.tagext.TagSupport | -
findAncestorWithClass, getId, getParent, getValue, getValues, removeValue, setId, setPageContext, setParent, setValue |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| Methods inherited from interface javax.servlet.jsp.tagext.Tag | -
getParent, setPageContext, setParent |
-
| -Constructor Detail | -
-EncodeForHTMLAttributeTag
--public EncodeForHTMLAttributeTag()-
-
-
| -Method Detail | -
-doStartTag
--public int doStartTag()-
-
-
-
-
-
- -
-doAfterBody
--public int doAfterBody() - throws javax.servlet.jsp.JspTagException-
-
-
-
-
-
- Throws: -
javax.servlet.jsp.JspTagException
-
- -
-getName
--public java.lang.String getName()-
-
-
-
-
-
- -
-setName
--public void setName(java.lang.String name)-
-
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/tags/EncodeForHTMLJavaScriptTag.html b/javadoc/org/owasp/esapi/tags/EncodeForHTMLJavaScriptTag.html deleted file mode 100644 index 532b854a4..000000000 --- a/javadoc/org/owasp/esapi/tags/EncodeForHTMLJavaScriptTag.html +++ /dev/null @@ -1,380 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.tags
-
-Class EncodeForHTMLJavaScriptTag
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.jsp.tagext.BodyTag, javax.servlet.jsp.tagext.IterationTag, javax.servlet.jsp.tagext.JspTag, java.io.Serializable, javax.servlet.jsp.tagext.Tag -
-
-
-
- public class EncodeForHTMLJavaScriptTag
- extends javax.servlet.jsp.tagext.BodyTagSupport
-
-
-
- See Also:
- Serialized Form
- -
| -Field Summary | -
| Fields inherited from interface javax.servlet.jsp.tagext.BodyTag | -
EVAL_BODY_BUFFERED, EVAL_BODY_TAG |
-
| Fields inherited from interface javax.servlet.jsp.tagext.IterationTag | -
EVAL_BODY_AGAIN |
-
| Fields inherited from interface javax.servlet.jsp.tagext.Tag | -
EVAL_BODY_INCLUDE, EVAL_PAGE, SKIP_BODY, SKIP_PAGE |
-
| -Constructor Summary | -|
EncodeForHTMLJavaScriptTag()
-
-- |
-|
| -Method Summary | -|
- int |
-doAfterBody()
-
-- |
-
- int |
-doStartTag()
-
-- |
-
- java.lang.String |
-getName()
-
-- |
-
- void |
-setName(java.lang.String name)
-
-- |
-
| Methods inherited from class javax.servlet.jsp.tagext.BodyTagSupport | -
doEndTag, doInitBody, getBodyContent, getPreviousOut, release, setBodyContent |
-
| Methods inherited from class javax.servlet.jsp.tagext.TagSupport | -
findAncestorWithClass, getId, getParent, getValue, getValues, removeValue, setId, setPageContext, setParent, setValue |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| Methods inherited from interface javax.servlet.jsp.tagext.Tag | -
getParent, setPageContext, setParent |
-
| -Constructor Detail | -
-EncodeForHTMLJavaScriptTag
--public EncodeForHTMLJavaScriptTag()-
-
-
| -Method Detail | -
-doStartTag
--public int doStartTag()-
-
-
-
-
-
- -
-doAfterBody
--public int doAfterBody() - throws javax.servlet.jsp.JspTagException-
-
-
-
-
-
- Throws: -
javax.servlet.jsp.JspTagException
-
- -
-getName
--public java.lang.String getName()-
-
-
-
-
-
- -
-setName
--public void setName(java.lang.String name)-
-
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/tags/EncodeForHTMLTag.html b/javadoc/org/owasp/esapi/tags/EncodeForHTMLTag.html deleted file mode 100644 index c6526d460..000000000 --- a/javadoc/org/owasp/esapi/tags/EncodeForHTMLTag.html +++ /dev/null @@ -1,380 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.tags
-
-Class EncodeForHTMLTag
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.jsp.tagext.BodyTag, javax.servlet.jsp.tagext.IterationTag, javax.servlet.jsp.tagext.JspTag, java.io.Serializable, javax.servlet.jsp.tagext.Tag -
-
-
-
- public class EncodeForHTMLTag
- extends javax.servlet.jsp.tagext.BodyTagSupport
-
-
-
- See Also:
- Serialized Form
- -
| -Field Summary | -
| Fields inherited from interface javax.servlet.jsp.tagext.BodyTag | -
EVAL_BODY_BUFFERED, EVAL_BODY_TAG |
-
| Fields inherited from interface javax.servlet.jsp.tagext.IterationTag | -
EVAL_BODY_AGAIN |
-
| Fields inherited from interface javax.servlet.jsp.tagext.Tag | -
EVAL_BODY_INCLUDE, EVAL_PAGE, SKIP_BODY, SKIP_PAGE |
-
| -Constructor Summary | -|
EncodeForHTMLTag()
-
-- |
-|
| -Method Summary | -|
- int |
-doAfterBody()
-
-- |
-
- int |
-doStartTag()
-
-- |
-
- java.lang.String |
-getName()
-
-- |
-
- void |
-setName(java.lang.String name)
-
-- |
-
| Methods inherited from class javax.servlet.jsp.tagext.BodyTagSupport | -
doEndTag, doInitBody, getBodyContent, getPreviousOut, release, setBodyContent |
-
| Methods inherited from class javax.servlet.jsp.tagext.TagSupport | -
findAncestorWithClass, getId, getParent, getValue, getValues, removeValue, setId, setPageContext, setParent, setValue |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| Methods inherited from interface javax.servlet.jsp.tagext.Tag | -
getParent, setPageContext, setParent |
-
| -Constructor Detail | -
-EncodeForHTMLTag
--public EncodeForHTMLTag()-
-
-
| -Method Detail | -
-doStartTag
--public int doStartTag()-
-
-
-
-
-
- -
-doAfterBody
--public int doAfterBody() - throws javax.servlet.jsp.JspTagException-
-
-
-
-
-
- Throws: -
javax.servlet.jsp.JspTagException
-
- -
-getName
--public java.lang.String getName()-
-
-
-
-
-
- -
-setName
--public void setName(java.lang.String name)-
-
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/tags/EncodeForVBScriptTag.html b/javadoc/org/owasp/esapi/tags/EncodeForVBScriptTag.html deleted file mode 100644 index 8caca48ac..000000000 --- a/javadoc/org/owasp/esapi/tags/EncodeForVBScriptTag.html +++ /dev/null @@ -1,399 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.tags
-
-Class EncodeForVBScriptTag
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.jsp.tagext.BodyTag, javax.servlet.jsp.tagext.IterationTag, javax.servlet.jsp.tagext.JspTag, java.io.Serializable, javax.servlet.jsp.tagext.Tag -
-
-
-
- public class EncodeForVBScriptTag
- extends javax.servlet.jsp.tagext.BodyTagSupport
-
-
-
- See Also:
- Serialized Form
- -
| -Field Summary | -
| Fields inherited from interface javax.servlet.jsp.tagext.BodyTag | -
EVAL_BODY_BUFFERED, EVAL_BODY_TAG |
-
| Fields inherited from interface javax.servlet.jsp.tagext.IterationTag | -
EVAL_BODY_AGAIN |
-
| Fields inherited from interface javax.servlet.jsp.tagext.Tag | -
EVAL_BODY_INCLUDE, EVAL_PAGE, SKIP_BODY, SKIP_PAGE |
-
| -Constructor Summary | -|
EncodeForVBScriptTag()
-
-- |
-|
| -Method Summary | -|
- int |
-doAfterBody()
-
-- |
-
- int |
-doEndTag()
-
-- |
-
- int |
-doStartTag()
-
-- |
-
- java.lang.String |
-getName()
-
-- |
-
- void |
-setName(java.lang.String name)
-
-- |
-
| Methods inherited from class javax.servlet.jsp.tagext.BodyTagSupport | -
doInitBody, getBodyContent, getPreviousOut, release, setBodyContent |
-
| Methods inherited from class javax.servlet.jsp.tagext.TagSupport | -
findAncestorWithClass, getId, getParent, getValue, getValues, removeValue, setId, setPageContext, setParent, setValue |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| Methods inherited from interface javax.servlet.jsp.tagext.Tag | -
getParent, setPageContext, setParent |
-
| -Constructor Detail | -
-EncodeForVBScriptTag
--public EncodeForVBScriptTag()-
-
-
| -Method Detail | -
-doStartTag
--public int doStartTag()-
-
-
-
-
-
- -
-doEndTag
--public int doEndTag()-
-
-
-
-
-
- -
-doAfterBody
--public int doAfterBody() - throws javax.servlet.jsp.JspTagException-
-
-
-
-
-
- Throws: -
javax.servlet.jsp.JspTagException
-
- -
-getName
--public java.lang.String getName()-
-
-
-
-
-
- -
-setName
--public void setName(java.lang.String name)-
-
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/tags/LogoutTag.html b/javadoc/org/owasp/esapi/tags/LogoutTag.html deleted file mode 100644 index 2b7bdb3f9..000000000 --- a/javadoc/org/owasp/esapi/tags/LogoutTag.html +++ /dev/null @@ -1,399 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- -
-
-org.owasp.esapi.tags
-
-Class LogoutTag
--java.lang.Object --
-
-
- All Implemented Interfaces:
- javax.servlet.jsp.tagext.BodyTag, javax.servlet.jsp.tagext.IterationTag, javax.servlet.jsp.tagext.JspTag, java.io.Serializable, javax.servlet.jsp.tagext.Tag -
-
-
-
- public class LogoutTag
- extends javax.servlet.jsp.tagext.BodyTagSupport
-
-
-
- See Also:
- Serialized Form
- -
| -Field Summary | -
| Fields inherited from interface javax.servlet.jsp.tagext.BodyTag | -
EVAL_BODY_BUFFERED, EVAL_BODY_TAG |
-
| Fields inherited from interface javax.servlet.jsp.tagext.IterationTag | -
EVAL_BODY_AGAIN |
-
| Fields inherited from interface javax.servlet.jsp.tagext.Tag | -
EVAL_BODY_INCLUDE, EVAL_PAGE, SKIP_BODY, SKIP_PAGE |
-
| -Constructor Summary | -|
LogoutTag()
-
-- |
-|
| -Method Summary | -|
- int |
-doAfterBody()
-
-- |
-
- int |
-doEndTag()
-
-- |
-
- int |
-doStartTag()
-
-- |
-
- java.lang.String |
-getName()
-
-- |
-
- void |
-setName(java.lang.String name)
-
-- |
-
| Methods inherited from class javax.servlet.jsp.tagext.BodyTagSupport | -
doInitBody, getBodyContent, getPreviousOut, release, setBodyContent |
-
| Methods inherited from class javax.servlet.jsp.tagext.TagSupport | -
findAncestorWithClass, getId, getParent, getValue, getValues, removeValue, setId, setPageContext, setParent, setValue |
-
| Methods inherited from class java.lang.Object | -
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
-
| Methods inherited from interface javax.servlet.jsp.tagext.Tag | -
getParent, setPageContext, setParent |
-
| -Constructor Detail | -
-LogoutTag
--public LogoutTag()-
-
-
| -Method Detail | -
-doStartTag
--public int doStartTag()-
-
-
-
-
-
- -
-doEndTag
--public int doEndTag()-
-
-
-
-
-
- -
-doAfterBody
--public int doAfterBody() - throws javax.servlet.jsp.JspTagException-
-
-
-
-
-
- Throws: -
javax.servlet.jsp.JspTagException
-
- -
-getName
--public java.lang.String getName()-
-
-
-
-
-
- -
-setName
--public void setName(java.lang.String name)-
-
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV CLASS - NEXT CLASS | -- FRAMES - NO FRAMES - - - - | -||||||||||
| - SUMMARY: NESTED | FIELD | CONSTR | METHOD | --DETAIL: FIELD | CONSTR | METHOD | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/tags/class-use/EncodeForHTMLAttributeTag.html b/javadoc/org/owasp/esapi/tags/class-use/EncodeForHTMLAttributeTag.html deleted file mode 100644 index 6000869f9..000000000 --- a/javadoc/org/owasp/esapi/tags/class-use/EncodeForHTMLAttributeTag.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.tags.EncodeForHTMLAttributeTag
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/tags/class-use/EncodeForHTMLJavaScriptTag.html b/javadoc/org/owasp/esapi/tags/class-use/EncodeForHTMLJavaScriptTag.html deleted file mode 100644 index d1b5a2d35..000000000 --- a/javadoc/org/owasp/esapi/tags/class-use/EncodeForHTMLJavaScriptTag.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.tags.EncodeForHTMLJavaScriptTag
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/tags/class-use/EncodeForHTMLTag.html b/javadoc/org/owasp/esapi/tags/class-use/EncodeForHTMLTag.html deleted file mode 100644 index 4a6ba24d2..000000000 --- a/javadoc/org/owasp/esapi/tags/class-use/EncodeForHTMLTag.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.tags.EncodeForHTMLTag
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/tags/class-use/EncodeForVBScriptTag.html b/javadoc/org/owasp/esapi/tags/class-use/EncodeForVBScriptTag.html deleted file mode 100644 index b9b6674f2..000000000 --- a/javadoc/org/owasp/esapi/tags/class-use/EncodeForVBScriptTag.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.tags.EncodeForVBScriptTag
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/tags/class-use/LogoutTag.html b/javadoc/org/owasp/esapi/tags/class-use/LogoutTag.html deleted file mode 100644 index 7e4485f10..000000000 --- a/javadoc/org/owasp/esapi/tags/class-use/LogoutTag.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Class
org.owasp.esapi.tags.LogoutTag
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/tags/package-frame.html b/javadoc/org/owasp/esapi/tags/package-frame.html deleted file mode 100644 index 157c156cd..000000000 --- a/javadoc/org/owasp/esapi/tags/package-frame.html +++ /dev/null @@ -1,38 +0,0 @@ - - - - - -
|
-Classes
-
- -EncodeForHTMLAttributeTag - -EncodeForHTMLJavaScriptTag - -EncodeForHTMLTag - -EncodeForVBScriptTag |
-
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Package org.owasp.esapi.tags -
- -| -Class Summary | -|
| EncodeForHTMLAttributeTag | -- |
| EncodeForHTMLJavaScriptTag | -- |
| EncodeForHTMLTag | -- |
| EncodeForVBScriptTag | -- |
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV PACKAGE - NEXT PACKAGE | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/tags/package-tree.html b/javadoc/org/owasp/esapi/tags/package-tree.html deleted file mode 100644 index 47dd900e7..000000000 --- a/javadoc/org/owasp/esapi/tags/package-tree.html +++ /dev/null @@ -1,151 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Hierarchy For Package org.owasp.esapi.tags -
--
-
- Package Hierarchies:
- All Packages
-
-Class Hierarchy -
--
-
- class java.lang.Object
-
-
- class javax.servlet.jsp.tagext.TagSupport (implements javax.servlet.jsp.tagext.IterationTag, java.io.Serializable)
-
-
-
- class javax.servlet.jsp.tagext.BodyTagSupport (implements javax.servlet.jsp.tagext.BodyTag)
-
-
-
- class org.owasp.esapi.tags.EncodeForHTMLAttributeTag
- class org.owasp.esapi.tags.EncodeForHTMLJavaScriptTag
- class org.owasp.esapi.tags.EncodeForHTMLTag
- class org.owasp.esapi.tags.EncodeForVBScriptTag
- class javax.servlet.jsp.tagext.BodyTagSupport (implements javax.servlet.jsp.tagext.BodyTag)
-
- class javax.servlet.jsp.tagext.TagSupport (implements javax.servlet.jsp.tagext.IterationTag, java.io.Serializable)
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/org/owasp/esapi/tags/package-use.html b/javadoc/org/owasp/esapi/tags/package-use.html deleted file mode 100644 index e3af48529..000000000 --- a/javadoc/org/owasp/esapi/tags/package-use.html +++ /dev/null @@ -1,136 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Uses of Package
org.owasp.esapi.tags
--
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/overview-frame.html b/javadoc/overview-frame.html deleted file mode 100644 index e971885a9..000000000 --- a/javadoc/overview-frame.html +++ /dev/null @@ -1,54 +0,0 @@ - - - - - -
| - | -
| All Classes
-
-
-Packages
- |
-
- - - diff --git a/javadoc/overview-summary.html b/javadoc/overview-summary.html deleted file mode 100644 index ac416163c..000000000 --- a/javadoc/overview-summary.html +++ /dev/null @@ -1,234 +0,0 @@ - - - -
- -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-OWASP Enterprise Security API (ESAPI) -
-
-See:
-
- Description
-
- -
| -Packages | -|
| org.owasp.esapi | -The ESAPI interfaces and Exception classes model the most important security -functions to enterprise web applications. | -
| org.owasp.esapi.codecs | -- |
| org.owasp.esapi.errors | -A set of exception classes designed to model the error conditions that -frequently arise in enterprise web applications and web services. | -
| org.owasp.esapi.filters | -- |
| org.owasp.esapi.http | -A few simple mock classes to help test the ESAPI reference -implementation. | -
| org.owasp.esapi.reference | -This package contains reference implementations of the ESAPI interfaces. | -
| org.owasp.esapi.tags | -- |
-
The OWASP Enterprise Security API (ESAPI) is both a set of -interfaces and a reference implementation of a library that provides -enterprise web application developers the most important security -functions they need in order to build web applications and web services -that protect themselves against attacks.
- -The The Open Web Application -Security Project (OWASP) is a worldwide free and open community focused -on improving the security of application software. Our mission is to -make application security "visible," so that people and organizations -can make informed decisions about application security risks. Everyone -is free to participate in OWASP and all of our materials are available -under an open source license. The OWASP Foundation is a 501c3 -not-for-profit charitable organization that ensures the ongoing -availability and support for our work.
- -The OWASP ESAPI Project is led by Jeff Williams, Aspect Security - -
You can find more information about the ESAPI project, or join -the mailing list and help us make it better from the OWASP project page -at http://www.owasp.org/index.php/ESAPI.
- -
-
-The library builds on the excellent security libraries available, -such as Java Logging, JCE, and Adobe Commons FileUpload. It uses the -concepts from many of the security packages out there, such as ACEGI, -Apache Commons Validator, Microsoft's AntiXSS library, and many many -more. This library provides a single consistent interface to security -functions that is intuitive for enterprise developers.
- -
-
-Used properly, the ESAPI provides enough functions to protect -against most of the OWASP Top Ten. The only real exception is the -Insecure Communications category, which is generally outside the control -of the software developer.
- -This project and all associated code is Copyright (c) 2007 - The OWASP Foundation
- -The ESAPI is published by OWASP under the LGPL. You should read and accept the LICENSE -before you use, modify, and/or redistribute this software.
-- -
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/overview-tree.html b/javadoc/overview-tree.html deleted file mode 100644 index 4f4e04d06..000000000 --- a/javadoc/overview-tree.html +++ /dev/null @@ -1,219 +0,0 @@ - - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Hierarchy For All Packages
--
-
- Package Hierarchies:
- org.owasp.esapi, org.owasp.esapi.codecs, org.owasp.esapi.errors, org.owasp.esapi.filters, org.owasp.esapi.http, org.owasp.esapi.reference, org.owasp.esapi.tags
-
-Class Hierarchy -
--
-
- class java.lang.Object
-
-
- class junit.framework.Assert
-
-
- class junit.framework.TestCase (implements junit.framework.Test)
-
-
-
- class org.owasp.esapi.reference.AccessControllerTest
- class org.owasp.esapi.reference.AccessReferenceMapTest
- class org.owasp.esapi.AllTests
- class org.owasp.esapi.reference.AuthenticatorTest
- class org.owasp.esapi.reference.EncoderTest
- class org.owasp.esapi.reference.EncryptedPropertiesTest
- class org.owasp.esapi.reference.EncryptorTest
- class org.owasp.esapi.errors.EnterpriseSecurityExceptionTest
- class org.owasp.esapi.filters.ESAPIFilterTest
- class org.owasp.esapi.ESAPITest
- class org.owasp.esapi.reference.ExecutorTest
- class org.owasp.esapi.reference.HTTPUtilitiesTest
- class org.owasp.esapi.reference.IntegerAccessReferenceMapTest
- class org.owasp.esapi.reference.IntrusionDetectorTest
- class org.owasp.esapi.reference.LoggerTest
- class org.owasp.esapi.reference.RandomizerTest
- class org.owasp.esapi.reference.SafeFileTest
- class org.owasp.esapi.reference.UserTest
- class org.owasp.esapi.reference.ValidatorTest
- class junit.framework.TestCase (implements junit.framework.Test)
-
- class org.owasp.esapi.codecs.Base64
- class org.owasp.esapi.codecs.CSSCodec (implements org.owasp.esapi.codecs.Codec) -
- class org.owasp.esapi.reference.DefaultEncoder (implements org.owasp.esapi.Encoder) -
- class org.owasp.esapi.reference.DefaultEncryptedProperties (implements org.owasp.esapi.EncryptedProperties) -
- class org.owasp.esapi.reference.DefaultExecutor (implements org.owasp.esapi.Executor) -
- class org.owasp.esapi.reference.DefaultHTTPUtilities (implements org.owasp.esapi.HTTPUtilities) -
- class org.owasp.esapi.reference.DefaultIntrusionDetector (implements org.owasp.esapi.IntrusionDetector) -
- class org.owasp.esapi.reference.DefaultRandomizer (implements org.owasp.esapi.Randomizer) -
- class org.owasp.esapi.reference.DefaultSecurityConfiguration (implements org.owasp.esapi.SecurityConfiguration) -
- class org.owasp.esapi.reference.DefaultUser (implements java.io.Serializable, org.owasp.esapi.User) -
- class org.owasp.esapi.reference.DefaultValidator (implements org.owasp.esapi.Validator) -
- class org.owasp.esapi.ESAPI
- class org.owasp.esapi.filters.ESAPIFilter (implements javax.servlet.Filter) -
- class java.io.File (implements java.lang.Comparable, java.io.Serializable)
-
-
-
- class org.owasp.esapi.SafeFile
- class org.owasp.esapi.reference.FileBasedAccessController (implements org.owasp.esapi.AccessController) -
- class org.owasp.esapi.reference.FileBasedAuthenticator (implements org.owasp.esapi.Authenticator) -
- class org.owasp.esapi.codecs.HTMLEntityCodec (implements org.owasp.esapi.codecs.Codec) -
- class java.io.InputStream
-
-
- class java.io.FilterInputStream
-
-
- class org.owasp.esapi.codecs.Base64.InputStream
- class javax.servlet.ServletInputStream
-
-
- class org.owasp.esapi.http.TestServletInputStream
- class java.io.FilterInputStream
- class org.owasp.esapi.reference.IntegerAccessReferenceMap (implements org.owasp.esapi.AccessReferenceMap) -
- class org.owasp.esapi.reference.JavaEncryptor (implements org.owasp.esapi.Encryptor) -
- class org.owasp.esapi.reference.JavaLogFactory (implements org.owasp.esapi.LogFactory) -
- class org.owasp.esapi.codecs.JavaScriptCodec (implements org.owasp.esapi.codecs.Codec) -
- class org.owasp.esapi.codecs.MySQLCodec (implements org.owasp.esapi.codecs.Codec) -
- class org.owasp.esapi.codecs.OracleCodec (implements org.owasp.esapi.codecs.Codec) -
- class java.io.OutputStream
-
-
- class java.io.FilterOutputStream
-
-
- class org.owasp.esapi.codecs.Base64.OutputStream
- class java.io.FilterOutputStream
- class org.owasp.esapi.codecs.PercentCodec (implements org.owasp.esapi.codecs.Codec) -
- class org.owasp.esapi.codecs.PushbackString
- class org.owasp.esapi.reference.RandomAccessReferenceMap (implements org.owasp.esapi.AccessReferenceMap) -
- class org.owasp.esapi.filters.SafeHTTPFilter (implements javax.servlet.Filter) -
- class org.owasp.esapi.filters.SafeRequest (implements javax.servlet.http.HttpServletRequest) -
- class org.owasp.esapi.filters.SafeResponse (implements javax.servlet.http.HttpServletResponse) -
- class org.owasp.esapi.SecurityConfiguration.Threshold
- class org.owasp.esapi.StringUtilities
- class javax.servlet.jsp.tagext.TagSupport (implements javax.servlet.jsp.tagext.IterationTag, java.io.Serializable)
-
-
-
- class javax.servlet.jsp.tagext.BodyTagSupport (implements javax.servlet.jsp.tagext.BodyTag)
-
-
-
- class org.owasp.esapi.tags.EncodeForHTMLAttributeTag
- class org.owasp.esapi.tags.EncodeForHTMLJavaScriptTag
- class org.owasp.esapi.tags.EncodeForHTMLTag
- class org.owasp.esapi.tags.EncodeForVBScriptTag
- class javax.servlet.jsp.tagext.BodyTagSupport (implements javax.servlet.jsp.tagext.BodyTag)
-
- class org.owasp.esapi.http.TestFilterChain (implements javax.servlet.FilterChain) -
- class org.owasp.esapi.http.TestHttpServletRequest (implements javax.servlet.http.HttpServletRequest) -
- class org.owasp.esapi.http.TestHttpServletResponse (implements javax.servlet.http.HttpServletResponse) -
- class org.owasp.esapi.http.TestHttpSession (implements javax.servlet.http.HttpSession) -
- class org.owasp.esapi.http.TestRequestDispatcher (implements javax.servlet.RequestDispatcher) -
- class java.lang.Throwable (implements java.io.Serializable)
-
-
-
- class java.lang.Exception
-
-
- class org.owasp.esapi.errors.EnterpriseSecurityException
-
-
- class org.owasp.esapi.errors.AccessControlException
- class org.owasp.esapi.errors.AuthenticationException
-
-
- class org.owasp.esapi.errors.AuthenticationAccountsException
- class org.owasp.esapi.errors.AuthenticationCredentialsException
- class org.owasp.esapi.errors.AuthenticationHostException
- class org.owasp.esapi.errors.AuthenticationLoginException
- class org.owasp.esapi.errors.AvailabilityException
- class org.owasp.esapi.errors.CertificateException
- class org.owasp.esapi.errors.EncodingException
- class org.owasp.esapi.errors.EncryptionException
- class org.owasp.esapi.errors.ExecutorException
- class org.owasp.esapi.errors.IntegrityException
- class org.owasp.esapi.errors.ValidationException
-
-
- class org.owasp.esapi.errors.ValidationAvailabilityException
- class org.owasp.esapi.errors.ValidationUploadException
- class java.lang.RuntimeException
-
-
- class org.owasp.esapi.errors.IntrusionException
- class org.owasp.esapi.errors.EnterpriseSecurityException
- class java.lang.Exception
- class org.owasp.esapi.ValidationErrorList
- class org.owasp.esapi.codecs.VBScriptCodec (implements org.owasp.esapi.codecs.Codec) -
- class junit.framework.Assert
-Interface Hierarchy -
--
-
- interface org.owasp.esapi.AccessController
- interface org.owasp.esapi.AccessReferenceMap
- interface org.owasp.esapi.Authenticator
- interface org.owasp.esapi.codecs.Codec
- interface org.owasp.esapi.Encoder
- interface org.owasp.esapi.EncryptedProperties
- interface org.owasp.esapi.Encryptor
- interface org.owasp.esapi.Executor
- interface org.owasp.esapi.HTTPUtilities
- interface org.owasp.esapi.IntrusionDetector
- interface org.owasp.esapi.LogFactory
- interface org.owasp.esapi.Logger
- interface java.security.Principal
-
-
- interface org.owasp.esapi.User
- interface org.owasp.esapi.Randomizer
- interface org.owasp.esapi.SecurityConfiguration
- interface org.owasp.esapi.Validator
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/package-list b/javadoc/package-list deleted file mode 100644 index fd558a0b1..000000000 --- a/javadoc/package-list +++ /dev/null @@ -1,7 +0,0 @@ -org.owasp.esapi -org.owasp.esapi.codecs -org.owasp.esapi.errors -org.owasp.esapi.filters -org.owasp.esapi.http -org.owasp.esapi.reference -org.owasp.esapi.tags diff --git a/javadoc/packages.html b/javadoc/packages.html deleted file mode 100644 index ce9dc3256..000000000 --- a/javadoc/packages.html +++ /dev/null @@ -1,31 +0,0 @@ - - - - - -
- -
- -
-
- Frame version -
- Non-frame version.
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
-
-Serialized Form
-- -
| -Package org.owasp.esapi.errors | -
| -Class org.owasp.esapi.errors.AccessControlException extends EnterpriseSecurityException implements Serializable | -
-serialVersionUID: 1l - -
- -
| -Class org.owasp.esapi.errors.AuthenticationAccountsException extends AuthenticationException implements Serializable | -
-serialVersionUID: 1l - -
- -
| -Class org.owasp.esapi.errors.AuthenticationCredentialsException extends AuthenticationException implements Serializable | -
-serialVersionUID: 1l - -
- -
| -Class org.owasp.esapi.errors.AuthenticationException extends EnterpriseSecurityException implements Serializable | -
-serialVersionUID: 1l - -
- -
| -Class org.owasp.esapi.errors.AuthenticationHostException extends AuthenticationException implements Serializable | -
-serialVersionUID: 1l - -
- -
| -Class org.owasp.esapi.errors.AuthenticationLoginException extends AuthenticationException implements Serializable | -
-serialVersionUID: 1l - -
- -
| -Class org.owasp.esapi.errors.AvailabilityException extends EnterpriseSecurityException implements Serializable | -
-serialVersionUID: 1l - -
- -
| -Class org.owasp.esapi.errors.CertificateException extends EnterpriseSecurityException implements Serializable | -
-serialVersionUID: 1l - -
- -
| -Class org.owasp.esapi.errors.EncodingException extends EnterpriseSecurityException implements Serializable | -
-serialVersionUID: 1l - -
- -
| -Class org.owasp.esapi.errors.EncryptionException extends EnterpriseSecurityException implements Serializable | -
-serialVersionUID: 1l - -
- -
| -Class org.owasp.esapi.errors.EnterpriseSecurityException extends java.lang.Exception implements Serializable | -
-serialVersionUID: 1l - -
| -Serialized Fields | -
-logger
--Logger logger-
-
-
- The logger.
-
-
-
-
- -
-logMessage
--java.lang.String logMessage-
-
-
-
-
| -Class org.owasp.esapi.errors.ExecutorException extends EnterpriseSecurityException implements Serializable | -
-serialVersionUID: 1l - -
- -
| -Class org.owasp.esapi.errors.IntegrityException extends EnterpriseSecurityException implements Serializable | -
-serialVersionUID: 1l - -
- -
| -Class org.owasp.esapi.errors.IntrusionException extends java.lang.RuntimeException implements Serializable | -
-serialVersionUID: 1l - -
| -Serialized Fields | -
-logger
--Logger logger-
-
-
- The logger.
-
-
-
-
- -
-logMessage
--java.lang.String logMessage-
-
-
-
-
| -Class org.owasp.esapi.errors.ValidationAvailabilityException extends ValidationException implements Serializable | -
-serialVersionUID: 1l - -
- -
| -Class org.owasp.esapi.errors.ValidationException extends EnterpriseSecurityException implements Serializable | -
-serialVersionUID: 1l - -
| -Serialized Fields | -
-context
--java.lang.String context-
-
-
- The UI reference that caused this ValidationException
-
-
-
-
| -Class org.owasp.esapi.errors.ValidationUploadException extends ValidationException implements Serializable | -
-serialVersionUID: 1l - -
- -
-
- -
| -Package org.owasp.esapi.reference | -
| -Class org.owasp.esapi.reference.DefaultUser extends java.lang.Object implements Serializable | -
-serialVersionUID: 1l - -
| -Serialized Fields | -
-logger
--Logger logger-
-
-
- The logger.
-
-
-
-
- -
-accountId
--long accountId-
-
-
- The account id.
-
-
-
-
- -
-accountName
--java.lang.String accountName-
-
-
- The account name.
-
-
-
-
- -
-screenName
--java.lang.String screenName-
-
-
- The screen name.
-
-
-
-
- -
-csrfToken
--java.lang.String csrfToken-
-
-
- The csrf token.
-
-
-
-
- -
-roles
--java.util.Set roles-
-
-
- The roles.
-
-
-
-
- -
-locked
--boolean locked-
-
-
- The locked.
-
-
-
-
- -
-loggedIn
--boolean loggedIn-
-
-
- The logged in.
-
-
-
-
- -
-enabled
--boolean enabled-
-
-
- The enabled.
-
-
-
-
- -
-lastHostAddress
--java.lang.String lastHostAddress-
-
-
- The last host address used.
-
-
-
-
- -
-lastPasswordChangeTime
--java.util.Date lastPasswordChangeTime-
-
-
- The last password change time.
-
-
-
-
- -
-lastLoginTime
--java.util.Date lastLoginTime-
-
-
- The last login time.
-
-
-
-
- -
-lastFailedLoginTime
--java.util.Date lastFailedLoginTime-
-
-
- The last failed login time.
-
-
-
-
- -
-expirationTime
--java.util.Date expirationTime-
-
-
- The expiration time.
-
-
-
-
- -
-failedLoginCount
--int failedLoginCount-
-
-
- The failed login count.
-
-
-
-
- -
-MAX_ROLE_LENGTH
--int MAX_ROLE_LENGTH-
-
-
- See Also:
- Constant Field Values
-
-
-
- -
| -Package org.owasp.esapi | -
| -Class org.owasp.esapi.SafeFile extends java.io.File implements Serializable | -
-serialVersionUID: 1l - -
| -Serialized Fields | -
-percents
--java.util.regex.Pattern percents-
-
-
-
-
- -
-dirblacklist
--java.util.regex.Pattern dirblacklist-
-
-
-
-
- -
-fileblacklist
--java.util.regex.Pattern fileblacklist-
-
-
-
-
-
- -
| -Package org.owasp.esapi.tags | -
| -Class org.owasp.esapi.tags.EncodeForHTMLAttributeTag extends javax.servlet.jsp.tagext.BodyTagSupport implements Serializable | -
-serialVersionUID: 1l - -
| -Serialized Fields | -
-name
--java.lang.String name-
-
-
-
-
| -Class org.owasp.esapi.tags.EncodeForHTMLJavaScriptTag extends javax.servlet.jsp.tagext.BodyTagSupport implements Serializable | -
-serialVersionUID: 1l - -
| -Serialized Fields | -
-name
--java.lang.String name-
-
-
-
-
| -Class org.owasp.esapi.tags.EncodeForHTMLTag extends javax.servlet.jsp.tagext.BodyTagSupport implements Serializable | -
-serialVersionUID: 1l - -
| -Serialized Fields | -
-name
--java.lang.String name-
-
-
-
-
| -Class org.owasp.esapi.tags.EncodeForVBScriptTag extends javax.servlet.jsp.tagext.BodyTagSupport implements Serializable | -
-serialVersionUID: 1l - -
| -Serialized Fields | -
-name
--java.lang.String name-
-
-
-
-
-
- - - - - -
-
-
|
-- - | -||||||||||
| - PREV - NEXT | -- FRAMES - NO FRAMES - - - - | -||||||||||
- - - diff --git a/javadoc/stylesheet.css b/javadoc/stylesheet.css deleted file mode 100644 index 14c3737e8..000000000 --- a/javadoc/stylesheet.css +++ /dev/null @@ -1,29 +0,0 @@ -/* Javadoc style sheet */ - -/* Define colors, fonts and other style attributes here to override the defaults */ - -/* Page background color */ -body { background-color: #FFFFFF } - -/* Headings */ -h1 { font-size: 145% } - -/* Table colors */ -.TableHeadingColor { background: #CCCCFF } /* Dark mauve */ -.TableSubHeadingColor { background: #EEEEFF } /* Light mauve */ -.TableRowColor { background: #FFFFFF } /* White */ - -/* Font used in left-hand frame lists */ -.FrameTitleFont { font-size: 100%; font-family: Helvetica, Arial, sans-serif } -.FrameHeadingFont { font-size: 90%; font-family: Helvetica, Arial, sans-serif } -.FrameItemFont { font-size: 90%; font-family: Helvetica, Arial, sans-serif } - -/* Navigation bar fonts and colors */ -.NavBarCell1 { background-color:#EEEEFF;} /* Light mauve */ -.NavBarCell1Rev { background-color:#00008B;} /* Dark Blue */ -.NavBarFont1 { font-family: Arial, Helvetica, sans-serif; color:#000000;} -.NavBarFont1Rev { font-family: Arial, Helvetica, sans-serif; color:#FFFFFF;} - -.NavBarCell2 { font-family: Arial, Helvetica, sans-serif; background-color:#FFFFFF;} -.NavBarCell3 { font-family: Arial, Helvetica, sans-serif; background-color:#FFFFFF;} - diff --git a/lib/antisamy-bin.1.2.jar b/lib/antisamy-bin.1.2.jar deleted file mode 100644 index 1189dcbfc..000000000 Binary files a/lib/antisamy-bin.1.2.jar and /dev/null differ diff --git a/lib/batik-css.jar b/lib/batik-css.jar deleted file mode 100644 index 33c6ff0e1..000000000 Binary files a/lib/batik-css.jar and /dev/null differ diff --git a/lib/batik-util.jar b/lib/batik-util.jar deleted file mode 100644 index 240e89394..000000000 Binary files a/lib/batik-util.jar and /dev/null differ diff --git a/lib/commons-codec-1.3.jar b/lib/commons-codec-1.3.jar deleted file mode 100644 index 957b6752a..000000000 Binary files a/lib/commons-codec-1.3.jar and /dev/null differ diff --git a/lib/commons-fileupload-1.2-sources.jar b/lib/commons-fileupload-1.2-sources.jar deleted file mode 100644 index a6ca5f79c..000000000 Binary files a/lib/commons-fileupload-1.2-sources.jar and /dev/null differ diff --git a/lib/commons-fileupload-1.2.jar b/lib/commons-fileupload-1.2.jar deleted file mode 100644 index 12539f5ed..000000000 Binary files a/lib/commons-fileupload-1.2.jar and /dev/null differ diff --git a/lib/commons-httpclient-3.1.jar b/lib/commons-httpclient-3.1.jar deleted file mode 100644 index 7c59774ae..000000000 Binary files a/lib/commons-httpclient-3.1.jar and /dev/null differ diff --git a/lib/commons-io-1.3.2-sources.jar b/lib/commons-io-1.3.2-sources.jar deleted file mode 100644 index b383cf381..000000000 Binary files a/lib/commons-io-1.3.2-sources.jar and /dev/null differ diff --git a/lib/commons-io-1.3.2.jar b/lib/commons-io-1.3.2.jar deleted file mode 100644 index 865c9e41c..000000000 Binary files a/lib/commons-io-1.3.2.jar and /dev/null differ diff --git a/lib/commons-logging-1.1.1.jar b/lib/commons-logging-1.1.1.jar deleted file mode 100644 index 8758a96b7..000000000 Binary files a/lib/commons-logging-1.1.1.jar and /dev/null differ diff --git a/lib/jsp-api.jar b/lib/jsp-api.jar deleted file mode 100644 index 6647cb571..000000000 Binary files a/lib/jsp-api.jar and /dev/null differ diff --git a/lib/junit-4.4.jar b/lib/junit-4.4.jar deleted file mode 100644 index 649b0b327..000000000 Binary files a/lib/junit-4.4.jar and /dev/null differ diff --git a/lib/nekohtml.jar b/lib/nekohtml.jar deleted file mode 100644 index 0be02315f..000000000 Binary files a/lib/nekohtml.jar and /dev/null differ diff --git a/lib/proguard.jar b/lib/proguard.jar deleted file mode 100644 index 248355cd0..000000000 Binary files a/lib/proguard.jar and /dev/null differ diff --git a/lib/servlet-api.jar b/lib/servlet-api.jar deleted file mode 100644 index 2fb91b486..000000000 Binary files a/lib/servlet-api.jar and /dev/null differ diff --git a/lib/task.properties b/lib/task.properties deleted file mode 100644 index b676db7c3..000000000 --- a/lib/task.properties +++ /dev/null @@ -1,2 +0,0 @@ -proguard = proguard.ant.ProGuardTask -proguardconfiguration = proguard.ant.ConfigurationTask diff --git a/lib/xercesImpl.jar b/lib/xercesImpl.jar deleted file mode 100644 index 8f762e1a8..000000000 Binary files a/lib/xercesImpl.jar and /dev/null differ diff --git a/lib/xml-apis-ext.jar b/lib/xml-apis-ext.jar deleted file mode 100644 index 8076110f7..000000000 Binary files a/lib/xml-apis-ext.jar and /dev/null differ diff --git a/lib/xml-apis.jar b/lib/xml-apis.jar deleted file mode 100644 index d42c0ea6c..000000000 Binary files a/lib/xml-apis.jar and /dev/null differ diff --git a/local.properties b/local.properties deleted file mode 100644 index 2af564f0e..000000000 --- a/local.properties +++ /dev/null @@ -1 +0,0 @@ -proguard.location=${basedir} \ No newline at end of file diff --git a/pom.xml b/pom.xml new file mode 100644 index 000000000..6797acc2a --- /dev/null +++ b/pom.xml @@ -0,0 +1,1030 @@ + +
+ * The implementation of this interface will need to access the current User object (from Authenticator.getCurrentUser()) + * to determine roles or permissions. In addition, the implementation + * will also need information about the resources that are being accessed. Using the user information and the resource + * information, the implementation should return an access control decision. + *
+ * Implementers are encouraged to implement the ESAPI access control rules, like assertAuthorizedForFunction() using + * existing access control mechanisms, such as methods like isUserInRole() or hasPrivilege(). While powerful, + * methods like isUserInRole() can be confusing for developers, as users may be in multiple roles or possess multiple + * overlapping privileges. Direct use of these finer grained access control methods encourages the use of complex boolean + * tests throughout the code, which can easily lead to developer mistakes. + *
+ * The point of the ESAPI access control interface is to centralize access control logic behind easy to use calls like + * assertAuthorized() so that access control is easy to use and easy to verify. Here is an example of a very + * straightforward to implement, understand, and verify ESAPI access control check: + * + *
+ * try {
+ * ESAPI.accessController().assertAuthorized("businessFunction", runtimeData);
+ * // execute BUSINESS_FUNCTION
+ * } catch (AccessControlException ace) {
+ * ... attack in progress
+ * }
+ *
+ *
+ * Note that in the user interface layer, access control checks can be used to control whether particular controls are
+ * rendered or not. These checks are supposed to fail when an unauthorized user is logged in, and do not represent
+ * attacks. Remember that regardless of how the user interface appears, an attacker can attempt to invoke any business
+ * function or access any data in your application. Therefore, access control checks in the user interface should be
+ * repeated in both the business logic and data layers.
+ *
+ *
+ * <% if ( ESAPI.accessController().isAuthorized( "businessFunction", runtimeData ) ) { %>
+ * <a href="/doAdminFunction">ADMIN</a>
+ * <% } else { %>
+ * <a href="/doNormalFunction">NORMAL</a>
+ * <% } %>
+ *
+ *
+ * @author Mike H. Fauzy (mike.fauzy@aspectsecurity.com) ESAPI v1.6-
+ * @author Jeff Williams (jeff.williams@aspectsecurity.com) ESAPI v0-1.5
+ */
+public interface AccessController {
+
+ /**
+ * isAuthorized executes the AccessControlRule
+ * that is identified by key and listed in the
+ * resources/ESAPI-AccessControlPolicy.xml file. It returns
+ * true if the AccessControlRule decides that the operation
+ * should be allowed. Otherwise, it returns false. Any exception thrown by
+ * the AccessControlRule must result in false. If
+ * key does not map to an AccessControlRule, then
+ * false is returned.
+ *
+ * Developers should call isAuthorized to control execution flow. For
+ * example, if you want to decide whether to display a UI widget in the
+ * browser using the same logic that you will use to enforce permissions
+ * on the server, then isAuthorized is the method that you want to use.
+ *
+ * Typically, assertAuthorized should be used to enforce permissions on the
+ * server.
+ *
+ * @param key key maps to
+ * <AccessControlPolicy><AccessControlRules>
+ * <AccessControlRule name="key"
+ * @param runtimeParameter runtimeParameter can contain anything that
+ * the AccessControlRule needs from the runtime system.
+ * @return Returns true if and only if the AccessControlRule specified
+ * by key exists and returned true.
+ * Otherwise returns false
+ */
+ boolean isAuthorized(Object key, Object runtimeParameter);
+
+ /**
+ * assertAuthorized executes the AccessControlRule
+ * that is identified by key and listed in the
+ * resources/ESAPI-AccessControlPolicy.xml file. It does
+ * nothing if the AccessControlRule decides that the operation
+ * should be allowed. Otherwise, it throws an
+ * org.owasp.esapi.errors.AccessControlException. Any exception
+ * thrown by the AccessControlRule will also result in an
+ * AccesControlException. If key does not map to
+ * an AccessControlRule, then an AccessControlException
+ * is thrown.
+ *
+ * Developers should call {@code assertAuthorized} to enforce privileged access to
+ * the system. It should be used to answer the question: "Should execution
+ * continue." Ideally, the call to assertAuthorized should
+ * be integrated into the application framework so that it is called
+ * automatically.
+ *
+ * @param key key maps to
+ * <AccessControlPolicy><AccessControlRules>
+ * <AccessControlRule name="key"
+ * @param runtimeParameter runtimeParameter can contain anything that
+ * the AccessControlRule needs from the runtime system.
+ */
+ void assertAuthorized(Object key, Object runtimeParameter)
+ throws AccessControlException;
+
+
+
+
+ /*** Below this line has been deprecated as of ESAPI 1.6 ***/
+
+
+
+
+ /**
+ * Checks if the current user is authorized to access the referenced URL. Generally, this method should be invoked in the
+ * application's controller or a filter as follows:
+ * ESAPI.accessController().isAuthorizedForURL(request.getRequestURI().toString());+ * + * The implementation of this method should call assertAuthorizedForURL(String url), and if an AccessControlException is + * not thrown, this method should return true. This way, if the user is not authorized, false would be returned, and the + * exception would be logged. + * + * @param url + * the URL as returned by request.getRequestURI().toString() + * + * @return + * true, if is authorized for URL + */ + @Deprecated + boolean isAuthorizedForURL(String url); + + /** + * Checks if the current user is authorized to access the referenced function. + * + * The implementation of this method should call assertAuthorizedForFunction(String functionName), and if an + * AccessControlException is not thrown, this method should return true. + * + * @param functionName + * the name of the function + * + * @return + * true, if is authorized for function + */ + @Deprecated + boolean isAuthorizedForFunction(String functionName); + + + /** + * Checks if the current user is authorized to access the referenced data, represented as an Object. + * + * The implementation of this method should call assertAuthorizedForData(String action, Object data), and if an + * AccessControlException is not thrown, this method should return true. + * + * @param action + * The action to verify for an access control decision, such as a role, or an action being performed on the object + * (e.g., Read, Write, etc.), or the name of the function the data is being passed to. + * + * @param data + * The actual object or object identifier being accessed or a reference to the object being accessed. + * + * @return + * true, if is authorized for the data + */ + @Deprecated + boolean isAuthorizedForData(String action, Object data); + + /** + * Checks if the current user is authorized to access the referenced file. + * + * The implementation of this method should call assertAuthorizedForFile(String filepath), and if an AccessControlException + * is not thrown, this method should return true. + * + * @param filepath + * the path of the file to be checked, including filename + * + * @return + * true, if is authorized for the file + */ + @Deprecated + boolean isAuthorizedForFile(String filepath); + + /** + * Checks if the current user is authorized to access the referenced service. This can be used in applications that + * provide access to a variety of back end services. + * + * The implementation of this method should call assertAuthorizedForService(String serviceName), and if an + * AccessControlException is not thrown, this method should return true. + * + * @param serviceName + * the service name + * + * @return + * true, if is authorized for the service + */ + @Deprecated + boolean isAuthorizedForService(String serviceName); + + /** + * Checks if the current user is authorized to access the referenced URL. The implementation should allow + * access to be granted to any part of the URL. Generally, this method should be invoked in the + * application's controller or a filter as follows: + *
ESAPI.accessController().assertAuthorizedForURL(request.getRequestURI().toString());+ * + * This method throws an AccessControlException if access is not authorized, or if the referenced URL does not exist. + * If the User is authorized, this method simply returns. + *
+ * Specification: The implementation should do the following: + *
-
+ *
- Check to see if the resource exists and if not, throw an AccessControlException + *
- Use available information to make an access control decision + *
- Ideally, this policy would be data driven + *
- You can use the current User, roles, data type, data name, time of day, etc. + *
- Access control decisions must deny by default + *
- If access is not permitted, throw an AccessControlException with details + *
-
+ *
+ * This method throws an AccessControlException if access is not authorized, or if the referenced function does not exist. + * If the User is authorized, this method simply returns. + *
+ * Specification: The implementation should do the following: + *
-
+ *
- Check to see if the function exists and if not, throw an AccessControlException + *
- Use available information to make an access control decision + *
- Ideally, this policy would be data driven + *
- You can use the current User, roles, data type, data name, time of day, etc. + *
- Access control decisions must deny by default + *
- If access is not permitted, throw an AccessControlException with details + *
-
+ *
+ * Specification: The implementation should do the following: + *
-
+ *
- Check to see if the resource exists and if not, throw an AccessControlException + *
- Use available information to make an access control decision + *
- Ideally, this policy would be data driven + *
- You can use the current User, roles, data type, data name, time of day, etc. + *
- Access control decisions must deny by default + *
- If access is not permitted, throw an AccessControlException with details + *
-
+ *
+ * This method throws an AccessControlException if access is not authorized, or if the referenced File does not exist. + * If the User is authorized, this method simply returns. + *
+ * Specification: The implementation should do the following: + *
-
+ *
- Check to see if the File exists and if not, throw an AccessControlException + *
- Use available information to make an access control decision + *
- Ideally, this policy would be data driven + *
- You can use the current User, roles, data type, data name, time of day, etc. + *
- Access control decisions must deny by default + *
- If access is not permitted, throw an AccessControlException with details + *
-
+ *
+ * This method throws an AccessControlException if access is not authorized, or if the referenced service does not exist. + * If the User is authorized, this method simply returns. + *
+ * Specification: The implementation should do the following: + *
-
+ *
- Check to see if the service exists and if not, throw an AccessControlException + *
- Use available information to make an access control decision + *
- Ideally, this policy would be data driven + *
- You can use the current User, roles, data type, data name, time of day, etc. + *
- Access control decisions must deny by default + *
- If access is not permitted, throw an AccessControlException with details + *
-
+ *
+ * Indirect references are handled as strings, to facilitate their use in HTML. + * Implementations can generate simple integers or more complicated random + * character strings as indirect references. Implementations should probably add + * a constructor that takes a list of direct references. + *
+ * Note that in addition to defeating all forms of parameter tampering attacks, + * there is a side benefit of the AccessReferenceMap. Using random strings as indirect object + * references, as opposed to simple integers makes it impossible for an attacker to + * guess valid identifiers. So if per-user AccessReferenceMaps are used, then request + * forgery (CSRF) attacks will also be prevented. + * + *
+ * Set fileSet = new HashSet(); + * fileSet.addAll(...); // add direct references (e.g. File objects) + * AccessReferenceMap map = new AccessReferenceMap( fileSet ); + * // store the map somewhere safe - like the session! + * String indRef = map.getIndirectReference( file1 ); + * String href = "http://www.aspectsecurity.com/esapi?file=" + indRef ); + * ... + * // if the indirect reference doesn't exist, it's likely an attack + * // getDirectReference throws an AccessControlException + * // you should handle as appropriate + * String indref = request.getParameter( "file" ); + * File file = (File)map.getDirectReference( indref ); + *+ * + *
+ *
+ * @author Jeff Williams (jeff.williams@aspectsecurity.com)
+ * @author Chris Schmidt (chrisisbeef@gmail.com)
+ */
+public interface AccessReferenceMap
+ * One possible implementation relies on the use of a thread local variable to
+ * store the current user's identity. The application is responsible for calling
+ * setCurrentUser() as soon as possible after each HTTP request is received. The
+ * value of getCurrentUser() is used in several other places in this API. This
+ * eliminates the need to pass a user object to methods throughout the library.
+ * For example, all of the logging, access control, and exception calls need
+ * access to the currently logged in user.
+ *
+ * The goal is to minimize the responsibility of the developer for
+ * authentication. In this example, the user simply calls authenticate with the
+ * current request and the name of the parameters containing the username and
+ * password. The implementation should verify the password if necessary, create
+ * a session if necessary, and set the user as the current user.
+ *
+ *
+ * This method is typically used for "reauthentication" for the most sensitive functions, such
+ * as transactions, changing email address, and changing other account information.
+ *
+ * @param user
+ * the user who requires verification
+ * @param password
+ * the hashed user-supplied password
+ *
+ * @return
+ * true, if the password is correct for the specified user
+ *
+ * @see #hashPassword(String password, String accountName)
+ */
+ boolean verifyPassword(User user, String password);
+
+ /**
+ * Logs out the current user.
+ *
+ * This is usually done by calling User.logout on the current User.
+ */
+ void logout();
+
+ /**
+ * Creates a new User with the information provided. Implementations should check
+ * accountName and password for proper format and strength against brute force
+ * attacks ( verifyAccountNameStrength(String), verifyPasswordStrength(String, String) ).
+ *
+ * Two copies of the new password are required to encourage user interface designers to
+ * include a "re-type password" field in their forms. Implementations should verify that
+ * both are the same.
+ *
+ * WARNING: The implementation of this method as defined in the
+ * default reference implementation class, {@code FileBasedAuthenticator},
+ * uses a password hash algorithm that is known to be weak. You are advised
+ * to replace the default reference implementation class with your own custom
+ * implementation that uses a stronger password hashing algorithm.
+ * See class comments in * {@code FileBasedAuthenticator} for further details.
+ *
+ * @param accountName
+ * the account name of the new user
+ * @param password1
+ * the password of the new user
+ * @param password2
+ * the password of the new user. This field is to encourage user interface designers to include two password fields in their forms.
+ *
+ * @return
+ * the User that has been created
+ *
+ * @throws AuthenticationException
+ * if user creation fails due to any of the qualifications listed in this method's description
+ */
+ User createUser(String accountName, String password1, String password2) throws AuthenticationException;
+
+ /**
+ * Generate a strong password. Implementations should use a large character set that does not
+ * include confusing characters, such as i I 1 l 0 o and O. There are many algorithms to
+ * generate strong memorable passwords that have been studied in the past.
+ *
+ * @return
+ * a password with strong password strength
+ */
+ String generateStrongPassword();
+
+ /**
+ * Generate strong password that takes into account the user's information and old password. Implementations
+ * should verify that the new password does not include information such as the username, fragments of the
+ * old password, and other information that could be used to weaken the strength of the password.
+ *
+ * @param user
+ * the user whose information to use when generating password
+ * @param oldPassword
+ * the old password to use when verifying strength of new password. The new password may be checked for fragments of oldPassword.
+ *
+ * @return
+ * a password with strong password strength
+ */
+ String generateStrongPassword(User user, String oldPassword);
+
+ /**
+ * Changes the password for the specified user. This requires the current password, as well as
+ * the password to replace it with. The new password should be checked against old hashes to be sure the new password does not closely resemble or equal any recent passwords for that User.
+ * Password strength should also be verified. This new password must be repeated to ensure that the user has typed it in correctly.
+ *
+ * @param user
+ * the user to change the password for
+ * @param currentPassword
+ * the current password for the specified user
+ * @param newPassword
+ * the new password to use
+ * @param newPassword2
+ * a verification copy of the new password
+ *
+ * @throws AuthenticationException
+ * if any errors occur
+ */
+ void changePassword(User user, String currentPassword, String newPassword, String newPassword2) throws AuthenticationException;
+
+ /**
+ * Returns the User matching the provided accountId. If the accoundId is not found, an Anonymous
+ * User or null may be returned.
+ *
+ * @param accountId
+ * the account id
+ *
+ * @return
+ * the matching User object, or the Anonymous User if no match exists
+ */
+ User getUser(long accountId);
+
+ /**
+ * Returns the User matching the provided accountName. If the accoundId is not found, an Anonymous
+ * User or null may be returned.
+ *
+ * @param accountName
+ * the account name
+ *
+ * @return
+ * the matching User object, or the Anonymous User if no match exists
+ */
+ User getUser(String accountName);
+
+ /**
+ * Gets a collection containing all the existing user names.
+ *
+ * @return
+ * a set of all user names
+ */
+ Set getUserNames();
+
+ /**
+ * Returns the currently logged in User.
+ *
+ * @return
+ * the matching User object, or the Anonymous User if no match
+ * exists
+ */
+ User getCurrentUser();
+
+ /**
+ * Sets the currently logged in User.
+ *
+ * @param user
+ * the user to set as the current user
+ */
+ void setCurrentUser(User user);
+
+ /**
+ * Returns a string representation of the hashed password, using the
+ * accountName as the salt. The salt helps to prevent against "rainbow"
+ * table attacks where the attacker pre-calculates hashes for known strings.
+ * This method specifies the use of the user's account name as the "salt"
+ * value. The Encryptor.hash method can be used if a different salt is
+ * required.
+ *
+ * WARNING: The implementation of this method as defined in the
+ * default reference implementation class, {@code FileBasedAuthenticator},
+ * is know to be extremely weak. The reference implementation class was
+ * meant to be an example implementation and generally should be avoided
+ * and replaced with your own implementation. See class comments in
+ * {@code FileBasedAuthenticator} for further details.
+ *
+ * @param password
+ * the password to hash
+ * @param accountName
+ * the account name to use as the salt
+ *
+ * @return
+ * the hashed password
+ * @throws EncryptionException
+ *
+ * @see org.owasp.esapi.reference.FileBasedAuthenticator FileBasedAuthenticator,
+ * the default reference implementation of this interface.
+ */
+ String hashPassword(String password, String accountName) throws EncryptionException;
+
+ /**
+ * Removes the account of the specified accountName.
+ *
+ * @param accountName
+ * the account name to remove
+ *
+ * @throws AuthenticationException
+ * the authentication exception if user does not exist
+ */
+ void removeUser(String accountName) throws AuthenticationException;
+
+ /**
+ * Ensures that the account name passes site-specific complexity requirements, like minimum length.
+ *
+ * @param accountName
+ * the account name
+ *
+ * @throws AuthenticationException
+ * if account name does not meet complexity requirements
+ */
+ void verifyAccountNameStrength(String accountName) throws AuthenticationException;
+
+ /**
+ * Ensures that the password meets site-specific complexity requirements, like length or number
+ * of character sets. This method takes the old password so that the algorithm can analyze the
+ * new password to see if it is too similar to the old password. Note that this has to be
+ * invoked when the user has entered the old password, as the list of old
+ * credentials stored by ESAPI is all hashed.
+ * Additionally, the user object is taken in order to verify the password and account name differ.
+ *
+ * @param oldPassword
+ * the old password
+ * @param newPassword
+ * the new password
+ * @param user
+ * the user
+ *
+ * @throws AuthenticationException
+ * if newPassword is too similar to oldPassword or if newPassword does not meet complexity requirements
+ */
+ void verifyPasswordStrength(String oldPassword, String newPassword, User user) throws AuthenticationException;
+
+ /**
+ * Determine if the account exists.
+ *
+ * @param accountName
+ * the account name
+ *
+ * @return true, if the account exists
+ */
+ boolean exists(String accountName);
+
+}
diff --git a/src/main/java/org/owasp/esapi/ESAPI.java b/src/main/java/org/owasp/esapi/ESAPI.java
new file mode 100644
index 000000000..55e4d896d
--- /dev/null
+++ b/src/main/java/org/owasp/esapi/ESAPI.java
@@ -0,0 +1,299 @@
+/**
+ * OWASP Enterprise Security API (ESAPI)
+ *
+ * This file is part of the Open Web Application Security Project (OWASP)
+ * Enterprise Security API (ESAPI) project. For details, please see
+ * http://www.owasp.org/index.php/ESAPI.
+ *
+ * Copyright (c) 2008 - The OWASP Foundation
+ *
+ * The ESAPI is published by OWASP under the BSD license. You should read and accept the
+ * LICENSE before you use, modify, and/or redistribute this software.
+ *
+ * @author Mike Fauzy Aspect Security
+ * @author Rogan Dawes Aspect Security
+ * @created 2008
+ */
+package org.owasp.esapi;
+
+import java.util.Arrays;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.owasp.esapi.util.ObjFactory;
+import org.owasp.esapi.errors.ConfigurationException;
+
+/**
+ * ESAPI locator class is provided to make it easy to gain access to the current ESAPI classes in use.
+ * Use the set methods to override the reference implementations with instances of any custom ESAPI implementations.
+ */
+public final class ESAPI {
+ private static String securityConfigurationImplName = System.getProperty("org.owasp.esapi.SecurityConfiguration", "org.owasp.esapi.reference.DefaultSecurityConfiguration");
+
+ /**
+ * prevent instantiation of this class
+ */
+ private ESAPI() {
+ }
+
+ /**
+ * Clears the current User, HttpRequest, and HttpResponse associated with the current thread. This method
+ * MUST be called as some containers do not properly clear threadlocal variables when the execution of
+ * a thread is complete. The suggested approach is to put this call in a finally block inside a filter.
+ *
+ * UserProfile profile = arm.getDirectReference( indirectRef );
+ *
+ *
+ * Will throw a AccessControlException if the object stored in memory is not of type
+ * UserProfile.
+ *
+ * However,
+ *
+ * Object uncastObject = arm.getDirectReference( indirectRef );
+ *
+ *
+ * Will never throw a AccessControlException as long as the object exists. If you are
+ * unsure of the object type of that an indirect reference references you should get
+ * the uncast object and test for type in the calling code.
+ *
+ * Object uncastProfile = arm.getDirectReference( indirectRef );
+ * if ( uncastProfile instanceof UserProfile ) {
+ * UserProfile userProfile = (UserProfile) uncastProfile;
+ * // ...
+ * } else {
+ * EmployeeProfile employeeProfile = (EmployeeProfile) uncastProfile;
+ * // ...
+ * }
+ *
+ *
+ * @param indirectReference
+ * the indirect reference
+ *
+ * @return
+ * the direct reference
+ *
+ * @throws AccessControlException
+ * if no direct reference exists for the specified indirect reference
+ * @throws ClassCastException
+ * if the implied type is not the same as the referenced object type
+ */
+
+ * public void doPost(ServletRequest request, ServletResponse response) {
+ * try {
+ * User user = ESAPI.authenticator().login(request, response);
+ * // continue with authenticated user
+ * } catch (AuthenticationException e) {
+ * // handle failed authentication (it's already been logged)
+ * }
+ *
+ *
+ * @author Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security
+ * @since June 1, 2007
+ */
+public interface Authenticator {
+
+ /**
+ * Clears the current User. This allows the thread to be reused safely.
+ *
+ * This clears all threadlocal variables from the thread. This should ONLY be called after
+ * all possible ESAPI operations have concluded. If you clear too early, many calls will
+ * fail, including logging, which requires the user identity.
+ */
+ void clearCurrent();
+
+ /**
+ * Calls login with the *current* request and response.
+ * @return Authenticated {@code User} if login is successful.
+ * @see HTTPUtilities#setCurrentHTTP(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
+ */
+ User login() throws AuthenticationException;
+
+ /**
+ * This method should be called for every HTTP request, to login the current user either from the session of HTTP
+ * request. This method will set the current user so that getCurrentUser() will work properly.
+ *
+ * Authenticates the user's credentials from the HttpServletRequest if
+ * necessary, creates a session if necessary, and sets the user as the
+ * current user.
+ *
+ * Specification: The implementation should do the following:
+ * 1) Check if the User is already stored in the session
+ * a. If so, check that session absolute and inactivity timeout have not expired
+ * b. Step 2 may not be required if 1a has been satisfied
+ * 2) Verify User credentials
+ * a. It is recommended that you use
+ * loginWithUsernameAndPassword(HttpServletRequest, HttpServletResponse) to verify credentials
+ * 3) Set the last host of the User (ex. user.setLastHostAddress(address) )
+ * 4) Verify that the request is secure (ex. over SSL)
+ * 5) Verify the User account is allowed to be logged in
+ * a. Verify the User is not disabled, expired or locked
+ * 6) Assign User to session variable
+ *
+ * @param request
+ * the current HTTP request
+ * @param response
+ * the HTTP response
+ *
+ * @return
+ * the User
+ *
+ * @throws AuthenticationException
+ * if the credentials are not verified, or if the account is disabled, locked, expired, or timed out
+ */
+ User login(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException;
+
+ /**
+ * Verify that the supplied password matches the password for this user. Password should
+ * be stored as a hash. By default, this method verifies password hashes created via the
+ * {@code hashPassword(password, accountName)} method in this class, however see WARNING
+ * the {@code hashPassword} method.
+ *
+ public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException {
+ try {
+ HttpServletRequest request = (HttpServletRequest) req;
+ HttpServletResponse response = (HttpServletResponse) resp;
+ ESAPI.httpUtilities().setCurrentHTTP(request, response);
+ ESAPI.authenticator().login();
+ chain.doFilter(request, response);
+ } catch (Exception e) {
+ logger.error( Logger.SECURITY_FAILURE, "Error in ESAPI security filter: " + e.getMessage(), e );
+ } finally {
+ // VERY IMPORTANT
+ // clear out ThreadLocal variables
+ ESAPI.clearCurrent();
+ }
+ }
+ *
+ * The advantages of having identity everywhere are worth the risk here.
+ */
+ public static void clearCurrent() {
+ authenticator().clearCurrent();
+ httpUtilities().clearCurrent();
+ }
+
+ /**
+ * Get the current HTTP Servlet Request being processed.
+ * @return the current HTTP Servlet Request.
+ */
+ public static HttpServletRequest currentRequest() {
+ return httpUtilities().getCurrentRequest();
+ }
+
+ /**
+ * Get the current HTTP Servlet Response being generated.
+ * @return the current HTTP Servlet Response.
+ */
+ public static HttpServletResponse currentResponse() {
+ return httpUtilities().getCurrentResponse();
+ }
+
+ /**
+ * @return the current ESAPI AccessController object being used to maintain the access control rules for this application.
+ */
+ public static AccessController accessController() {
+ return ObjFactory.make( securityConfiguration().getAccessControlImplementation(), "AccessController" );
+ }
+
+ /**
+ * @return the current ESAPI Authenticator object being used to authenticate users for this application.
+ */
+ public static Authenticator authenticator() {
+ return ObjFactory.make( securityConfiguration().getAuthenticationImplementation(), "Authenticator" );
+ }
+
+ /**
+ * The ESAPI {@code Encoder} is primarily used to provide output encoding to
+ * prevent Cross-Site Scripting (XSS).
+ * @return the current ESAPI {@code Encoder} object being used to encode and decode data for this application.
+ */
+ public static Encoder encoder() {
+ return ObjFactory.make( securityConfiguration().getEncoderImplementation(), "Encoder" );
+ }
+
+ /**
+ * ESAPI {@code Encryptor} provides a set of methods for performing common encryption, random number, and
+ * hashing operations.
+ * @return the current ESAPI {@code Encryptor} object being used to encrypt and decrypt data for this application.
+ */
+ public static Encryptor encryptor() {
+ return ObjFactory.make( securityConfiguration().getEncryptionImplementation(), "Encryptor" );
+ }
+
+ /**
+ * @return the current ESAPI Executor object being used to safely execute OS commands for this application.
+ */
+ public static Executor executor() {
+ return ObjFactory.make( securityConfiguration().getExecutorImplementation(), "Executor" );
+ }
+
+ /**
+ * @return the current ESAPI HTTPUtilities object being used to safely access HTTP requests and responses
+ * for this application.
+ */
+ public static HTTPUtilities httpUtilities() {
+ return ObjFactory.make( securityConfiguration().getHTTPUtilitiesImplementation(), "HTTPUtilities" );
+ }
+
+ /**
+ * @return the current ESAPI IntrusionDetector being used to monitor for intrusions in this application.
+ */
+ public static IntrusionDetector intrusionDetector() {
+ return ObjFactory.make( securityConfiguration().getIntrusionDetectionImplementation(), "IntrusionDetector" );
+ }
+
+ /**
+ * Get the current LogFactory being used by ESAPI. If there isn't one yet, it will create one, and then
+ * return this same LogFactory from then on.
+ * @return The current LogFactory being used by ESAPI.
+ */
+ private static LogFactory logFactory() {
+ return ObjFactory.make( securityConfiguration().getLogImplementation(), "LogFactory" );
+ }
+
+ /**
+ * @param clazz The class to associate the logger with.
+ * @return The current Logger associated with the specified class.
+ */
+ public static Logger getLogger(Class clazz) {
+ return logFactory().getLogger(clazz);
+ }
+
+ /**
+ * @param moduleName The module to associate the logger with.
+ * @return The current Logger associated with the specified module.
+ */
+ public static Logger getLogger(String moduleName) {
+ return logFactory().getLogger(moduleName);
+ }
+
+ /**
+ * @return The default Logger.
+ */
+ public static Logger log() {
+ return logFactory().getLogger("DefaultLogger");
+ }
+
+ /**
+ * @return the current ESAPI Randomizer being used to generate random numbers in this application.
+ */
+ public static Randomizer randomizer() {
+ return ObjFactory.make( securityConfiguration().getRandomizerImplementation(), "Randomizer" );
+ }
+
+ private static volatile SecurityConfiguration overrideConfig = null;
+
+ /**
+ * @return the current ESAPI SecurityConfiguration being used to manage the security configuration for
+ * ESAPI for this application.
+ */
+ public static SecurityConfiguration securityConfiguration() {
+ // copy the volatile into a non-volatile to prevent TOCTTOU race condition
+ SecurityConfiguration override = overrideConfig;
+ if ( override != null ) {
+ return override;
+ }
+
+ return ObjFactory.make( securityConfigurationImplName, "SecurityConfiguration" );
+ }
+
+ /**
+ * @return the current ESAPI Validator being used to validate data in this application.
+ */
+ public static Validator validator() {
+ return ObjFactory.make( securityConfiguration().getValidationImplementation(), "Validator" );
+ }
+
+ // TODO: This should probably use the SecurityManager or some value within the current
+ // securityConfiguration to determine if this method is allowed to be called. This could
+ // allow for unit tests internal to ESAPI to modify the configuration for the purpose of
+ // testing stuff, and allow developers to allow this in development environments but make
+ // it so the securityConfiguration implementation *cannot* be modified in production environments.
+ //
+ // The purpose of this method is to replace the functionality provided by the setSecurityConfiguration
+ // method that is no longer on this class, and allow the context configuration of the ESAPI
+ // to be modified at Runtime.
+ public static String initialize( String impl ) {
+ String oldImpl = securityConfigurationImplName;
+ securityConfigurationImplName = impl;
+ return oldImpl;
+ }
+
+ /**
+ * Overrides the current security configuration with a new implementation. This is meant
+ * to be used as a temporary means to alter the behavior of the ESAPI and should *NEVER*
+ * be used in a production environment as it will affect the behavior and configuration of
+ * the ESAPI *GLOBALLY*.
+ *
+ * To clear an overridden Configuration, simple call this method with null for the config
+ * parameter.
+ *
+ * @param config The new security configuration.
+ */
+ public static void override( SecurityConfiguration config ) {
+ overrideConfig = config;
+ }
+
+ // KWW - OPEN ISSUE: I don't like placing this here, but it's convenient and I
+ // don't really know a better place for it and would rather not create
+ // a whole new utility class just to use it.
+ /**
+ * Determine if a given fully qualified (ESAPI) method name has been explicitly
+ * enabled in the ESAPI.properties's file via the property name
+ * ESAPI.dangerouslyAllowUnsafeMethods.methodNames. Note that there
+ * is no real reason for an ESAPI client to use this, It is intended for
+ * interal use,
+ *
+ * The reason this method exists is because certain (other) ESAPI method names + * are considered "unsafe" and therefore should be used with extra caution. + * These "unsafe" methods may include methods that are: + *
-
+ *
- Deprecated and thus no longer suggested for long term use. + *
- Methods where the programming contract is not in itself sufficient to ensure safety alone + * and developers are expected to take addional actions on their own to secure their application. + *
- Methods that are using some unpatched transitive dependency that we haven't firmly + * established grounds for it not being exploitable in the manner that ESAPI uses it. + *
- Methods whose reference implementations are not scalable to the enterprise level. + *
+ * Note that this method is intended primarilly for internal ESAPI use and if we were + * using Java Modules (in JDK 9 and later), this method would not be exported. + *
+ * For further details, please see the ESAPI GitHub wiki article, + * "Reducing the ESAPI Library's Attack Surface". + * @param fullyQualifiedMethodName A fully qualified ESAPI class name (so, should start + * "org.owasp.esapi.") followed by the method name (but without + * parenthesis or any parameter signature information. + * @return {@code true} if the parameter {@code fullyQualifiedMethodName} is in the comma-separated + * list of values in the ESAPI property ESAPI.dangerouslyAllowUnsafeMethods.methodNames, + * otherwise {@code false} is returned. + */ + public static boolean isMethodExplicityEnabled(String fullyQualifiedMethodName) { + if ( fullyQualifiedMethodName == null || fullyQualifiedMethodName.trim().isEmpty() ) { + throw new IllegalArgumentException("Program error: fullyQualifiedMethodName parameter cannot be null or empty"); + } + String desiredMethodName = fullyQualifiedMethodName.trim(); + // This regex is too liberal to be anything more than just a trivial + // sanity test to protect against typos. + if ( !desiredMethodName.matches("^org\\.owasp\\.esapi\\.(\\p{Alnum}|\\.)*$") ) { + throw new IllegalArgumentException("Program error: fullyQualifiedMethodName must start with " + + "'org.owasp.esapi.' and be a valid method name."); + } + + String enabledMethods = null; + try { + // Need to do this w/in a try/catch because if the property is not + // found, getStringProp will throw a ConfigurationException rather + // than returning a null. + enabledMethods = securityConfiguration().getStringProp("ESAPI.dangerouslyAllowUnsafeMethods.methodNames"); + } catch( ConfigurationException cex ) { + return false; // Property not found at all. + } + + + // Split it up by ',' and then filter it by finding the first on that + // matches the desired method name passed in as the method parameter. + // If no matches, return the empty string. + String result = Arrays.stream( enabledMethods.trim().split(",") ) + .filter(methodName -> methodName.trim().equals( desiredMethodName ) ) + .findFirst() + .orElse(""); + return !result.isEmpty(); + } +} diff --git a/src/main/java/org/owasp/esapi/Encoder.java b/src/main/java/org/owasp/esapi/Encoder.java new file mode 100644 index 000000000..409b27b24 --- /dev/null +++ b/src/main/java/org/owasp/esapi/Encoder.java @@ -0,0 +1,761 @@ +/** + * OWASP Enterprise Security API (ESAPI) + * + * This file is part of the Open Web Application Security Project (OWASP) + * Enterprise Security API (ESAPI) project. For details, please see + * http://www.owasp.org/index.php/ESAPI. + * + * Copyright (c) 2007-2019 - The OWASP Foundation + * + * The ESAPI is published by OWASP under the BSD license. You should read and accept the + * LICENSE before you use, modify, and/or redistribute this software. + * + * @author Jeff Williams Aspect Security + * @created 2007 + */ +package org.owasp.esapi; + +import java.io.IOException; +import java.net.URI; + +import org.owasp.esapi.codecs.Codec; +import org.owasp.esapi.errors.EncodingException; + + +/** + * The {@code Encoder} interface contains a number of methods for decoding input and encoding output + * so that it will be safe for a variety of interpreters. Its primary use is to + * provide output encoding to prevent XSS. + *
+ * To prevent double-encoding, callers should make sure input does not already contain encoded characters + * by calling one of the {@code canonicalize()} methods. Validator implementations should call + * {@code canonicalize()} on user input before validating to prevent encoded attacks. + *
+ * All of the methods must use an "allow list" or "positive" security model rather + * than a "deny list" or "negative" security model. For the encoding methods, this means that + * all characters should be encoded, except for a specific list of "immune" characters that are + * known to be safe. + *
+ * The {@code Encoder} performs two key functions, encoding (also referred to as "escaping" in this Javadoc) + * and decoding. These functions rely on a set of codecs that can be found in the + * {@code org.owasp.esapi.codecs} package. These include: + *
-
+ *
- CSS Escaping + *
- HTMLEntity Encoding + *
- JavaScript Escaping + *
- MySQL Database Escaping + *
- Oracle Database Escaping + *
- JSON Escaping + *
- Percent Encoding (aka URL Encoding) + *
- Unix Shell Escaping + *
- VBScript Escaping + *
- Windows Cmd Escaping + *
- LDAP Escaping + *
- XML and XML Attribute Encoding + *
- XPath Escaping + *
- Base64 Encoding + *
+ * The primary use of ESAPI {@code Encoder} is to prevent XSS vulnerabilities by + * providing output encoding using the various "encodeForXYZ()" methods, + * where XYZ is one of CSS, HTML, HTMLAttribute, JavaScript, or URL. When + * using the ESAPI output encoders, it is important that you use the one for the + * appropriate context where the output will be rendered. For example, it + * the output appears in an JavaScript context, you should use {@code encodeForJavaScript} + * (note this includes all of the DOM JavaScript event handler attributes such as + * 'onfocus', 'onclick', 'onload', etc.). If the output would be rendered in an HTML + * attribute context (with the exception of the aforementioned 'onevent' type event + * handler attributes), you would use {@code encodeForHTMLAttribute}. If you are + * encoding anywhere a URL is expected (e.g., a 'href' attribute for for <a> or + * a 'src' attribute on a <img> tag, etc.), then you should use use {@code encodeForURL}. + * If encoding CSS, then use {@code encodeForCSS}. Etc. This is because there are + * different escaping requirements for these different contexts. Developers who are + * new to ESAPI or to defending against XSS vulnerabilities are highly encouraged to + * first read the + * + * OWASP Cross-Site Scripting Prevention Cheat Sheet. + *
+ * Note that in addition to these encoder methods, ESAPI also provides a JSP Tag + * Library ({@code META-INF/esapi.tld}) in the ESAPI jar. This allows one to use + * the more convenient JSP tags in JSPs. These JSP tags are simply wrappers for the + * various these "encodeForXXYZ()" method docmented in this {@code Encoder} + * interface. + *
+ * Some important final words: + *
-
+ *
- Where to output encode for HTML rendering: + * Knowing where to place the output encoding in your code + * is just as important as knowing which context (HTML, HTML attribute, CSS, + * JavaScript, or URL) to use for the output encoding and surprisingly the two + * are often related. In general, output encoding should be done just prior to the + * output being rendered (that is, as close to the 'sink' as possible) because that + * is what determines what the appropriate context is for the output encoding. + * In fact, doing output encoding on untrusted data that is stored and to + * be used later--whether stored in an HTTP session or in a database--is almost + * always considered an anti-pattern. An example of this is one gathers and + * stores some untrusted data item such as an email address from a user. A + * developer thinks "let's output encode this and store the encoded data in + * the database, thus making the untrusted data safe to use all the time, thus + * saving all of us developers all the encoding troubles later on". On the surface, + * that sounds like a reasonable approach. The problem is how to know what + * output encoding to use, not only for now, but for all possible future + * uses? It might be that the current application code base is only using it in + * an HTML context that is displayed in an HTML report or shown in an HTML + * context in the user's profile. But what if it is later used in a {@code mailto:} URL? + * Then instead of HTML encoding, it would need to have URL encoding. Similarly, + * what if there is a later switch made to use AJAX and the untrusted email + * address gets used in a JavaScript context? The complication is that even if + * you know with certainty today all the ways that an untrusted data item is + * used in your application, it is generally impossible to predict all the + * contexts that it may be used in the future, not only in your application, but + * in other applications that could access that data in the database. + * + *
- Avoiding multiple nested contexts: + * A really tricky situation to get correct is when there are multiple nested + * encoding contexts. But far, the most common place this seems to come up is + * untrusted URLs used in JavaScript. How should you handle that? Well, + * the best way is to rewrite your code to avoid it! An example of + * this that is well worth reading may be found at + * ESAPI-DEV mailing list archives: + * URL encoding within JavaScript. Be sure to read the entire thread. + * The question itself is too nuanced to be answered in Javadoc, but now, + * hopefully you are at least aware of the potential pitfalls. There is little + * available research or examples on how to do output encoding when multiple + * mixed encodings are required, although one that you may find useful is + * + * Automated Detecting and Repair of Cross-SiteScripting Vulnerabilities through Unit Testing + * It at least discusses a few of the common errors involved in multiple mixed + * encoding contexts. + *
- A word about unit testing:
+ * Unit testing this is hard. You may be satisfied with stopped after you have
+ * tested against the ubiquitous XSS test case of
+ *
+ * </script>alert(1)</script> + *
+ * or similar simplistic XSS attack payloads and if that is properly encoded + * (or, you don't see an alert box popped in your browser), you consider it + * "problem fixed", and consider the unit testing sufficient. Unfortunately, that + * minimalist testing may not always detect places where you used the wrong output + * encoder. You need to do better. Fortunately, the aforementioned link, + * + * Automated Detecting and Repair of Cross-SiteScripting Vulnerabilities through Unit Testing + * provides some insight on this. You may also wish to look at the + * ESAPI Encoder JUnittest cases for ideas. + * If you are really ambitious, an excellent resource for XSS attack patterns is + * BeEF - The Browser Exploitation Framework Project. + * - A final note on {@code Encoder} implementation details: + * Most of the {@code Encoder} methods make extensive use of ESAPI's {@link org.owasp.esapi.codecs.Codec} + * classes under-the-hood. These {@code Codec} classes are intended for use for encoding and decoding + * input based on some particular context or specification. While the OWASP team + * over the years have made every effort to be cautious--often going to extremes + * to make "safe harbor" decisions on harmful inputs other similar encoders assume are already safe + * (we did this to in order to protect the client's users from buggy browsers that don't adhere + * to the W3C HTML specications)&em;the various {@code Codec} implemtations can offer + * NO GUARANTEE of safety of the content being encoded or decoded. Therefore, + * it is highly advised to practice a security-in-depth approach for everything you do. + * By following that advice, you will minimize the impact and/or likelihood of any + * vulnerabilities from bugs in the ESAPI code or accidental misuse of the ESAPI + * library on your part. In particular, whenever there are cases where cients use + * any of these {@link org.owasp.esapi.codecs.Codec} classes directly, it is highly + * recommended to perform canonicalization followed by strict input valiation both + * prior to encoding and after decoding to protect your application from input-based + * attacks. + * + *
+ * Encoder.AllowMultipleEncoding=false + * Encoder.AllowMixedEncoding=false + *+ * and the default codecs that are used for canonicalization are the list + * of codecs that comes from: + *
+ * Encoder.DefaultCodecList=HTMLEntityCodec,PercentCodec,JavaScriptCodec + *+ * (If the {@code Encoder.DefaultCodecList} property is null or not set, + * these same codecs are listed in the same order. Note that you may supply + * your own codec by using a fully cqualified class name of a class that + * implements {@code org.owasp.esapi.codecs.Codec
+ * Everyone says you shouldn't do validation + * without canonicalizing the data first. This is easier said than done. The canonicalize method can + * be used to simplify just about any input down to its most basic form. Note that canonicalize doesn't + * handle Unicode issues, it focuses on higher level encoding and escaping schemes. In addition to simple + * decoding, canonicalize also handles: + *
- Perverse but legal variants of escaping schemes + *
- Multiple escaping (%2526 or <) + *
- Mixed escaping (%26lt;) + *
- Nested escaping (%%316 or &%6ct;) + *
- All combinations of multiple, mixed, and nested encoding/escaping (%253c or ┦gt;)
+ * Using canonicalize is simple. The default is just... + *
+ * String clean = ESAPI.encoder().canonicalize( request.getParameter("input"));
+ *
+ * You need to decode untrusted data so that it's safe for ANY downstream interpreter or decoder. For
+ * example, if your data goes into a Windows command shell, then into a database, and then to a browser,
+ * you're going to need to decode for all of those systems. You can build a custom encoder to canonicalize
+ * for your application like this...
+ * + * ArrayList list = new ArrayList(); + * list.add( new WindowsCodec() ); + * list.add( new MySQLCodec() ); + * list.add( new PercentCodec() ); + * Encoder encoder = new DefaultEncoder( list ); + * String clean = encoder.canonicalize( request.getParameter( "input" )); + *+ * or alternately, you can just customize {@code Encoder.DefaultCodecList} property + * in the {@code ESAPI.properties} file with your preferred codecs; for + * example: + *
+ * Encoder.DefaultCodecList=WindowsCodec,MySQLCodec,PercentCodec + *+ * and then use: + *
+ * Encoder encoder = ESAPI.encoder(); + * String clean = encoder.canonicalize( request.getParameter( "input" )); + *+ * as you normally would. However, the downside to using the + * {@code ESAPI.properties} file approach does not allow you to vary your + * list of codecs that are used each time. The downside to using the + * {@code DefaultEncoder} constructor is that your code is now timed to + * specific reference implementations rather than just interfaces and those + * reference implementations are what is most likely to change in ESAPI 3.x. + *
+ * In ESAPI, the {@code Validator} uses the {@code canonicalize} method before it does validation. So all you need to + * do is to validate as normal and you'll be protected against a host of encoded attacks. + *
+ * String input = request.getParameter( "name" ); + * String name = ESAPI.validator().isValidInput( "test", input, "FirstName", 20, false); + *+ * However, the default canonicalize() method only decodes HTMLEntity, percent (URL) encoding, and JavaScript + * encoding. If you'd like to use a custom canonicalizer with your validator, that's pretty easy too. + *
+ * ... setup custom encoder as above + * Validator validator = new DefaultValidator( encoder ); + * String input = request.getParameter( "name" ); + * String name = validator.isValidInput( "test", input, "name", 20, false); + *+ * Although ESAPI is able to canonicalize multiple, mixed, or nested encoding, it's safer to not accept + * this stuff in the first place. In ESAPI, the default is "strict" mode that throws an IntrusionException + * if it receives anything not single-encoded with a single scheme. This is configurable + * in {@code ESAPI.properties} using the properties: + *
+ * Encoder.AllowMultipleEncoding=false + * Encoder.AllowMixedEncoding=false + *+ * This method allows you to override the default behavior by directly specifying whether to restrict + * multiple or mixed encoding. Even if you disable restrictions, you'll still get + * warning messages in the log about each multiple encoding and mixed encoding received. + *
+ * // disabling strict mode to allow mixed encoding
+ * String url = ESAPI.encoder().canonicalize( request.getParameter("url"), false, false);
+ *
+ * WARNING #1!!! Please note that this method is incompatible with URLs and if there exist any HTML Entities
+ * that correspond with parameter values in a URL such as "¶" in a URL like
+ * "https://foo.com/?bar=foo¶meter=wrong" you will get a mixed encoding validation exception.
+ * + * If you wish to canonicalize a URL/URI use the method {@code Encoder.getCanonicalizedURI(URI dirtyUri);} + *
+ * WARNING #2!!! Even if you use {@code WindowsCodec} or {@code UnixCodec} + * as appropriate, file path names in the {@code input} parameter will NOT + * be canonicalized. It the failure of such file path name canonicalization + * presents a potential security issue, consider using one of the + * {@code Validator.getValidDirectoryPath()} methods instead of or in addition to this method. + * + * @see W3C specifications + * @see #canonicalize(String) + * @see #getCanonicalizedURI(URI dirtyUri) + * @see org.owasp.esapi.Validator#getValidDirectoryPath(java.lang.String, java.lang.String, java.io.File, boolean) + * + * @param input + * the text to canonicalize + * @param restrictMultiple + * true if checking for multiple encoding is desired, false otherwise + * @param restrictMixed + * true if checking for mixed encoding is desired, false otherwise + * + * @return a String containing the canonicalized text + */ + String canonicalize(String input, boolean restrictMultiple, boolean restrictMixed); + + /** + * Encode data for use in Cascading Style Sheets (CSS) content. + * + * @see CSS Syntax [w3.org] + * + * @param untrustedData + * the untrusted data to output encode for CSS + * + * @return the untrusted data safely output encoded for use in a CSS + */ + String encodeForCSS(String untrustedData); + + /** + * Encode data for use in HTML using HTML entity encoding + *
+ * Note that the following characters: + * 00-08, 0B-0C, 0E-1F, and 7F-9F + *
cannot be used in HTML.
+ *
+ * @see HTML Encodings [wikipedia.org]
+ * @see SGML Specification [w3.org]
+ * @see XML Specification [w3.org]
+ *
+ * @param untrustedData
+ * the untrusted data to output encode for HTML
+ *
+ * @return the untrusted data safely output encoded for use in a HTML
+ */
+ String encodeForHTML(String untrustedData);
+
+ /**
+ * Decodes HTML entities.
+ * @param input the String to decode
+ * @return the newly decoded String
+ */
+ String decodeForHTML(String input);
+
+ /**
+ * Encode data for use in HTML attributes.
+ *
+ * @param untrustedData
+ * the untrusted data to output encode for an HTML attribute
+ *
+ * @return the untrusted data safely output encoded for use in a use as an HTML attribute
+ */
+ String encodeForHTMLAttribute(String untrustedData);
+
+
+ /**
+ * Encode data for insertion inside a data value or function argument in JavaScript. Including user data
+ * directly inside a script is quite dangerous. Great care must be taken to prevent including user data
+ * directly into script code itself, as no amount of encoding will prevent attacks there.
+ *
+ * Please note there are some JavaScript functions that can never safely receive untrusted data
+ * as input – even if the user input is encoded.
+ *
+ * For example:
+ *
+ * <script>
+ * window.setInterval('<%= EVEN IF YOU ENCODE UNTRUSTED DATA YOU ARE XSSED HERE %>');
+ * </script>
+ *
+ * @param untrustedData
+ * the untrusted data to output encode for JavaScript
+ *
+ * @return the untrusted data safely output encoded for use in a use in JavaScript
+ */
+ String encodeForJavaScript(String untrustedData);
+
+ /**
+ * Encode data for insertion inside a data value in a Visual Basic script. Putting user data directly
+ * inside a script is quite dangerous. Great care must be taken to prevent putting user data
+ * directly into script code itself, as no amount of encoding will prevent attacks there.
+ *
+ * This method is not recommended as VBScript is only supported by Internet Explorer
+ *
+ * @param untrustedData
+ * the untrusted data to output encode for VBScript
+ *
+ * @return the untrusted data safely output encoded for use in a use in VBScript
+ */
+ String encodeForVBScript(String untrustedData);
+
+
+ /**
+ * Encode input for use in a SQL query, according to the selected codec
+ * (appropriate codecs include the {@link org.owasp.esapi.codecs.MySQLCodec}
+ * and {@link org.owasp.esapi.codecs.OracleCodec}), but see
+ * "SECURITY WARNING" below before using.
+ * + * The this method attempts to ensure make sure any single-quotes are double-quoted + * (i.e., as '', not double-quotes, as in "). Another possible approach + * is to use the {escape} syntax described in the JDBC specification in section 1.5.6. + * However, this syntax does not work with all drivers, and requires + * modification of all queries. + *
+ * SECURITY WARNING: This method is NOT recommended. The use of the {@code PreparedStatement} + * interface is the preferred approach. However, if for some reason + * this is impossible, then this method is provided as a significantly weaker + * alternative. In particular, it should be noted that if all you do to + * address potential SQL Injection attacks is to use this method to escape + * parameters, you will fail miserably. According to the + * + * OWASP SQL Injection Prevention Cheat Sheet, these are the primary + * defenses against SQL Injection (as of June 2025): + *
-
+ *
- Option 1: Use of Prepared Statements (with Parameterized Queries) + *
- Option 2: Use of Properly Constructed Stored Procedures + *
- Option 3: Allow-list Input Validation + *
- Option 4: STRONGLY DISCOURAGED: Escaping All User Supplied Input + *
+ * According to "Option 4" (which is what this method implements), that OWASP Cheat Sheet + * states: + *
+ * In this approach, the developer will escape all user input + * before putting it in a query. It is very database specific + * in its implementation. This methodology is frail compared + * to other defenses, and we CANNOT guarantee that this option + * will prevent all SQL injections in all situations. + *+ * (Emphasis ours.) + *
+ * Note you could give yourself a slightly better chance at success if prior to + * escaping by this method, you first canonicalize the input and run it through + * some strong allow-list validation. We will not provide anymore details than + * that, lest we encourage its misuse; however, it should be noted that resorting + * to use this method--especially by itself--should rarely, if ever, used. It + * is intended as a last ditch, emergency, Hail Mary effort. (To be honest, you'd + * likely have more success setting up a WAF such as + * OWASP ModSecurity and + * OWASP CRS + * if you need a temporary emergency SQLi defense shield, but using {@code PreparedStatement} + * is still your best option if you have the time and resources. + *
+ * Note to AppSec / Security Auditor teams: If see this method being used in + * application code, the risk of an exploitable SQLi vulnerability is still high. We + * stress the importance of the first two Options discussed in the + * + * OWASP SQL Injection Prevention Cheat Sheet. If you allow this, we recommend only + * doing so for a limited time duration and in the meantime creating some sort of security + * exception ticket to track it. + *
+ * IMPORTANT NOTE: If you really do insist enabling leg cannon mode and use + * this method, then you MUST follow these instructions. Failure to do so will + * result in a {@link org.owasp.esapi.errors.NotConfiguredByDefaultException} being + * thrown when you try to call it. Thus to make it work, you need to add the implementation + * method corresponding to this interace (defined in the property "ESAPI.Encoder" + * (wihch defaults to "org.owasp.esapi.reference.DefaultEncoder") in your "ESAPI.properties" file, + * to the ESAPI property "ESAPI.dangerouslyAllowUnsafeMethods.methodNames". See + * the Security Bulletin #13 document referenced below for additional details. + *
+ * @see JDBC Specification + * @see java.sql.PreparedStatement + * @see ESAPI Security Bulletin #13 + * + * @param codec + * a {@link org.owasp.esapi.codecs.Codec} that declares which database 'input' is being encoded for (ie. MySQL, Oracle, etc.) + * @param input + * the text to encode for SQL + * + * @return input encoded for use in SQL + * @see + * ESAPI Security Bulletin #13 + * @deprecated This method is considered dangerous and not easily made safe and thus under strong + * consideration to be removed within 1 years time after the 2.7.0.0 release. Please + * see the referenced ESAPI Security Bulletin #13 for further details. + */ + @Deprecated + String encodeForSQL(Codec codec, String input); + + /** + * Encode for an operating system command shell according to the selected codec (appropriate codecs include the WindowsCodec and UnixCodec). + * + * Please note the following recommendations before choosing to use this method: + * + * 1) It is strongly recommended that applications avoid making direct OS system calls if possible as such calls are not portable, and they are potentially unsafe. Please use language provided features if at all possible, rather than native OS calls to implement the desired feature. + * 2) If an OS call cannot be avoided, then it is recommended that the program to be invoked be invoked directly (e.g., System.exec("nameofcommand" + "parameterstocommand");) as this avoids the use of the command shell. The "parameterstocommand" should of course be validated before passing them to the OS command. + * 3) If you must use this method, then we recommend validating all user supplied input passed to the command shell as well, in addition to using this method in order to make the command shell invocation safe. + * + * An example use of this method would be: System.exec("dir " + ESAPI.encodeForOS(WindowsCodec, "parameter(s)tocommandwithuserinput"); + * + * @param codec + * a Codec that declares which operating system 'input' is being encoded for (ie. Windows, Unix, etc.) + * @param input + * the text to encode for the command shell + * + * @return input encoded for use in command shell + */ + String encodeForOS(Codec codec, String input); + + /** + * Encode data for use in LDAP queries. Wildcard (*) characters will be encoded. + * + * This encoder operates according to RFC 4515, Section 3. RFC 4515 says the following character ranges + * are valid: 0x01-0x27, 0x2B-0x5B and 0x5D-0x7F. Characters outside the ranges are hex encoded, and they + * include 0x00 (NUL), 0x28 (LPAREN), 0x29 (RPAREN), 0x2A (ASTERISK), and 0x5C (ESC). The encoder will also + * encode 0x2F (FSLASH), which is required by Microsoft Active Directory. + * + * NB: At ESAPI 2.5.3, {@code encodeForLDAP} began strict conformance with RFC 4515. Characters above 0x7F + * are converted to UTF-8, and then the byte sequences are hex encoded according to the RFC. + * + * @param input + * the text to encode for LDAP + * + * @return input encoded for use in LDAP + * + * @see RFC 4515, Lightweight Directory Access Protocol + * (LDAP): String Representation of Search Filters + * + * @since ESAPI 1.3 + */ + String encodeForLDAP(String input); + + /** + * Encode data for use in LDAP queries. You have the option whether or not to encode wildcard (*) characters. + * + * This encoder operates according to RFC 4515, Section 3. RFC 4515 says the following character ranges + * are valid: 0x01-0x27, 0x2B-0x5B and 0x5D-0x7F. Characters outside the ranges are hex encoded, and they + * include 0x00 (NUL), 0x28 (LPAREN), 0x29 (RPAREN), 0x2A (ASTERISK), and 0x5C (ESC). The encoder will also + * encode 0x2F (FSLASH), which is required by Microsoft Active Directory. + * + * NB: At ESAPI 2.5.3, {@code encodeForLDAP} began strict conformance with RFC 4515. Characters above 0x7F + * are converted to UTF-8, and then the byte sequences are hex encoded according to the RFC. + * + * @param input + * the text to encode for LDAP + * @param encodeWildcards + * whether or not wildcard (*) characters will be encoded. + * + * @return input encoded for use in LDAP + * + * @see RFC 4515, Lightweight Directory Access Protocol + * (LDAP): String Representation of Search Filters + * + * @since ESAPI 1.3 + */ + String encodeForLDAP(String input, boolean encodeWildcards); + + /** + * Encode data for use in an LDAP distinguished name. + * + * This encoder operates according to RFC 4514, Section 3. RFC 4514 says the following character ranges + * are valid: 0x01-0x21, 0x23-0x2A, 0x2D-0x3A, 0x3D, 0x3F-0x5B, 0x5D-0x7F. Characters outside the ranges + * are hex encoded, and they include 0x00 (NUL), 0x22 (DQUOTE), 0x2B (PLUS), 0x2C (COMMA), + * 0x3B (SEMI), 0x3C (LANGLE), 0x3E (RANGLE) and 0x5C (ESC). The encoder will also encode 0x2F (FSLASH), + * which is required by Microsoft Active Directory. The leading and trailing characters in a distinguished + * name string will also have 0x20 (SPACE) and 0x23 (SHARP) encoded. + * + * NB: At ESAPI 2.5.3, {@code encodeForDN} began strict conformance with RFC 4514. Characters above 0x7F + * are converted to UTF-8, and then the byte sequences are hex encoded according to the RFC. + * + * @param input + * the text to encode for an LDAP distinguished name + * + * @return input encoded for use in an LDAP distinguished name + * + * @see RFC 4514, Lightweight Directory Access Protocol + * (LDAP): String Representation of Distinguished Names + * + * @since ESAPI 1.3 + */ + String encodeForDN(String input); + + /** + * Encode data for use in an XPath query. + * + * NB: The reference implementation encodes almost everything and may over-encode. + * + * The difficulty with XPath encoding is that XPath has no built-in mechanism for escaping + * characters. It is possible to use XQuery in a parameterized way to + * prevent injection. + * + * For more information, refer to this + * article which specifies the following list of characters as the most + * dangerous: ^ & " * ' ; < > ( ) . This + * paper suggests disallowing ' and " in queries. + * + * @see XPath Injection [ibm.com] + * @see Blind XPath Injection [packetstormsecurity.org] + * + * @param input + * the text to encode for XPath + * @return + * input encoded for use in XPath + */ + String encodeForXPath(String input); + + /** + * Encode data for use in an XML element. The implementation should follow the Character Encoding in Entities + * from W3C. + *+ * The use of a real XML parser is strongly encouraged. However, in the + * hopefully rare case that you need to make sure that data is safe for + * inclusion in an XML document and cannot use a parser, this method provides + * a safe mechanism to do so. + * + * @see Character Encoding in Entities + * + * @param input + * the text to encode for XML + * + * @return + * input encoded for use in XML + */ + String encodeForXML(String input); + + /** + * Encode data for use in an XML attribute. The implementation should follow the Character Encoding in Entities + * from W3C. + *
+ * The use of a real XML parser is highly encouraged. However, in the
+ * hopefully rare case that you need to make sure that data is safe for
+ * inclusion in an XML document and cannot use a parse, this method provides
+ * a safe mechanism to do so.
+ *
+ * @see Character Encoding in Entities
+ *
+ * @param input
+ * the text to encode for use as an XML attribute
+ *
+ * @return
+ * input encoded for use in an XML attribute
+ */
+ String encodeForXMLAttribute(String input);
+
+ /**
+ * Encode for use in a URL. This method performs URL encoding
+ * on the entire string.
+ *
+ * @see URL encoding
+ *
+ * @param input
+ * the text to encode for use in a URL
+ *
+ * @return input
+ * encoded for use in a URL
+ *
+ * @throws EncodingException
+ * if encoding fails
+ */
+ String encodeForURL(String input) throws EncodingException;
+
+ /**
+ * Encode data for use in JSON strings. This method performs String escaping
+ * on the entire string according to RFC 8259, Section 7.
+ *
+ * @see RFC 8259,
+ * The JavaScript Object Notation (JSON) Data Interchange Format, Section 7
+ *
+ * @param input
+ * the text to escape for JSON string
+ *
+ * @return input
+ * escaped for use in JSON string
+ */
+ String encodeForJSON(String input);
+
+ /**
+ * Decode from URL. Implementations should first canonicalize and
+ * detect any double-encoding. If this check passes, then the data is decoded using URL
+ * decoding.
+ *
+ * @param input
+ * the text to decode from an encoded URL
+ *
+ * @return
+ * the decoded URL value
+ *
+ * @throws EncodingException
+ * if decoding fails
+ */
+ String decodeFromURL(String input) throws EncodingException;
+
+ /**
+ * Encode for Base64.
+ *
+ * @param input
+ * the text to encode for Base64
+ * @param wrap
+ * the encoder will wrap lines every 64 characters of output
+ *
+ * @return input encoded for Base64
+ */
+ String encodeForBase64(byte[] input, boolean wrap);
+
+ /**
+ * Decode data encoded with BASE-64 encoding.
+ *
+ * @param input
+ * the Base64 text to decode
+ *
+ * @return input decoded from Base64
+ *
+ * @throws IOException
+ */
+ byte[] decodeFromBase64(String input) throws IOException;
+
+ /**
+ * Get a version of the input URI that will be safe to run regex and other validations against.
+ * It is not recommended to persist this value as it will transform user input. This method
+ * will not test to see if the URI is RFC-3986 compliant.
+ *
+ * @param dirtyUri
+ * the tainted URI
+ * @return The canonicalized URI
+ */
+ String getCanonicalizedURI(URI dirtyUri);
+
+ /**
+ * Decode data encoded for JSON strings. This method removes String escaping
+ * on the entire string according to RFC 8259, Section 7.
+ *
+ * @see RFC 8259,
+ * The JavaScript Object Notation (JSON) Data Interchange Format, Section 7
+ *
+ * @param input
+ * the JSON string to decode
+ *
+ * @return input
+ * decoded from JSON string
+ */
+ String decodeFromJSON(String input);
+}
diff --git a/src/main/java/org/owasp/esapi/EncoderConstants.java b/src/main/java/org/owasp/esapi/EncoderConstants.java
new file mode 100644
index 000000000..ec2cbfac4
--- /dev/null
+++ b/src/main/java/org/owasp/esapi/EncoderConstants.java
@@ -0,0 +1,117 @@
+package org.owasp.esapi;
+
+import java.util.Set;
+
+import org.owasp.esapi.util.CollectionsUtil;
+
+/**
+ * Common character classes used for input validation, output encoding, verifying password strength
+ * CSRF token generation, generating salts, etc
+ * @author Neil Matatall (neil.matatall .at. gmail.com)
+ * @see User
+ */
+public class EncoderConstants {
+ /**
+ * !$*-.=?@_
+ */
+ public final static char[] CHAR_PASSWORD_SPECIALS = { '!', '$', '*', '-', '.', '=', '?', '@', '_' };
+ public final static Set
+ * The main property controlling the selection of the implementation class is the
+ * property {@code ESAPI.Encryptor} in {@code ESAPI.properties}. Most of the
+ * the other encryption related properties have property names that start with
+ * the string "Encryptor.". These properties all you to do things such as
+ * select the encryption algorithms, the preferred JCE provider, etc.
+ *
+ * In addition, there are two important properties (initially delivered as unset
+ * from the ESAPI download) named {@code Encryptor.MasterKey} and
+ * {@code Encryptor.MasterSalt} that must be set before using ESAPI encryption.
+ * There is a bash(1) shell script provided with the standard ESAPI distribution
+ * called 'setMasterKey.sh' that will assist you in setting these two properties. The
+ * script is in 'src/examples/scripts/setMasterKey.sh'.
+ *
+ * Possible future enhancements (depending on feedback) are discussed in
+ * section 4 of
+ *
+ * Design Goals in OWASP ESAPI Cryptography.
+ *
+ * @author Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security
+ * @since June 1, 2007
+ * @see User Guide for Symmetric Encryption in ESAPI 2.0
+ */
+public interface Encryptor {
+
+ /**
+ * Returns a string representation of the hash of the provided plaintext and
+ * salt. The salt helps to protect against a rainbow table attack by mixing
+ * in some extra data with the plaintext. Some good choices for a salt might
+ * be an account name or some other string that is known to the application
+ * but not to an attacker.
+ * See
+ * this article for more information about hashing as it pertains to password schemes.
+ *
+ * @param plaintext
+ * the plaintext String to encrypt
+ * @param salt
+ * the salt to add to the plaintext String before hashing
+ *
+ * @return
+ * the encrypted hash of 'plaintext' stored as a String
+ *
+ * @throws EncryptionException
+ * if the specified hash algorithm could not be found or another problem exists with
+ * the hashing of 'plaintext'
+ */
+ String hash(String plaintext, String salt) throws EncryptionException;
+
+ /**
+ * Returns a string representation of the hash of the provided plaintext and
+ * salt. The salt helps to protect against a rainbow table attack by mixing
+ * in some extra data with the plaintext. Some good choices for a salt might
+ * be an account name or some other string that is known to the application
+ * but not to an attacker.
+ * See
+ * this article for more information about hashing as it pertains to password schemes.
+ *
+ * @param plaintext
+ * the plaintext String to encrypt
+ * @param salt
+ * the salt to add to the plaintext String before hashing
+ * @param iterations
+ * the number of times to iterate the hash
+ *
+ * @return
+ * the encrypted hash of 'plaintext' stored as a String
+ *
+ * @throws EncryptionException
+ * if the specified hash algorithm could not be found or another problem exists with
+ * the hashing of 'plaintext'
+ */
+ String hash(String plaintext, String salt, int iterations) throws EncryptionException;
+
+ /**
+ * Encrypts the provided plaintext bytes using the cipher transformation
+ * specified by the property ESAPI.properties file.
+ *
+ * @author Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security
+ * @since June 1, 2007
+ */
+public interface EncryptedProperties {
+
+ /**
+ * Gets the property value from the encrypted store, decrypts it, and
+ * returns the plaintext value to the caller.
+ *
+ * @param key
+ * the name of the property to get
+ *
+ * @return
+ * The decrypted property value. null if the key is not set.
+ *
+ * @throws EncryptionException
+ * if the property could not be decrypted
+ */
+ String getProperty(String key) throws EncryptionException;
+
+ /**
+ * Encrypts the plaintext property value and stores the ciphertext value
+ * in the encrypted store.
+ *
+ * @param key
+ * the name of the property to set
+ * @param value
+ * the value of the property to set
+ *
+ * @return
+ * the previously encrypted property value for the specified key, or
+ * {@code null} if it did not have one.
+ *
+ * @throws EncryptionException
+ * if the property could not be encrypted
+ */
+ String setProperty(String key, String value) throws EncryptionException;
+
+ /**
+ * Returns a {@code Set} view of properties. The {@code Set} is backed by a
+ * {@code java.util.Hashtable}, so changes to the {@code Hashtable} are
+ * reflected in the {@code Set}, and vice-versa. The {@code Set} supports element
+ * removal (which removes the corresponding entry from the {@code Hashtable},
+ * but not element addition.
+ *
+ * @return
+ * a set view of the properties contained in this map.
+ */
+ Set keySet();
+
+ /**
+ * Reads a property list (key and element pairs) from the input stream.
+ *
+ * @param in
+ * the input stream that contains the properties file
+ *
+ * @throws IOException
+ * Signals that an I/O exception has occurred.
+ */
+ void load(InputStream in) throws IOException;
+
+ /**
+ * Writes this property list (key and element pairs) in this Properties table to
+ * the output stream in a format suitable for loading into a Properties table using the load method.
+ *
+ * @param out
+ * the output stream that contains the properties file
+ * @param comments
+ * a description of the property list (ex. "Encrypted Properties File").
+ *
+ * @throws IOException
+ * Signals that an I/O exception has occurred.
+ */
+ void store(OutputStream out, String comments) throws IOException;
+
+
+}
diff --git a/src/main/java/org/owasp/esapi/Encryptor.java b/src/main/java/org/owasp/esapi/Encryptor.java
new file mode 100644
index 000000000..c1729a839
--- /dev/null
+++ b/src/main/java/org/owasp/esapi/Encryptor.java
@@ -0,0 +1,316 @@
+/**
+ * OWASP Enterprise Security API (ESAPI)
+ *
+ * This file is part of the Open Web Application Security Project (OWASP)
+ * Enterprise Security API (ESAPI) project. For details, please see
+ * http://www.owasp.org/index.php/ESAPI.
+ *
+ * Copyright © 2007-2019 - The OWASP Foundation
+ *
+ * The ESAPI is published by OWASP under the BSD license. You should read and accept the
+ * LICENSE before you use, modify, and/or redistribute this software.
+ *
+ * @author Jeff Williams Aspect Security
+ * @author kevin.w.wall@gmail.com
+ * @created 2007
+ */
+package org.owasp.esapi;
+
+import javax.crypto.SecretKey;
+
+import org.owasp.esapi.crypto.CipherText;
+import org.owasp.esapi.crypto.PlainText;
+import org.owasp.esapi.errors.EncryptionException;
+import org.owasp.esapi.errors.IntegrityException;
+
+
+/**
+ * The Encryptor interface provides a set of methods for performing common
+ * encryption, random number, and hashing operations. Implementations should
+ * rely on a strong cryptographic implementation, such as JCE or BouncyCastle.
+ * Implementors should take care to ensure that they initialize their
+ * implementation with a strong "master key", and that they protect this secret
+ * as much as possible.
+ * Encryptor.CipherTransformation
+ * and the master encryption key as specified by the property
+ * {@code Encryptor.MasterKey} as defined in the ESAPI.properties file.
+ * Encryptor.CipherTransformation
+ * as defined in the ESAPI.properties file and the
+ * specified secret key.
+ *
+ * This method is similar to {@link #encrypt(PlainText)} except that it + * permits a specific {@code SecretKey} to be used for encryption. + * + * @param key The {@code SecretKey} to use for encrypting the plaintext. + * @param plaintext The byte stream to be encrypted. Note if a Java + * {@code String} is to be encrypted, it should be converted + * using {@code "some string".getBytes("UTF-8")}. + * @return the {@code CipherText} object from which the raw ciphertext, the + * IV, the cipher transformation, and many other aspects about + * the encryption detail may be extracted. + * @throws EncryptionException Thrown if something should go wrong such as + * the JCE provider cannot be found, the cipher algorithm, + * cipher mode, or padding scheme not being supported, specifying + * an unsupported key size, specifying an IV of incorrect length, + * etc. + * @see #encrypt(PlainText) + * @since 2.0 + */ + CipherText encrypt(SecretKey key, PlainText plaintext) + throws EncryptionException; + + /** + * Decrypts the provided {@link CipherText} using the information from it + * and the master encryption key as specified by the property + * {@code Encryptor.MasterKey} as defined in the {@code ESAPI.properties} + * file. + *
+ * @param ciphertext The {@code CipherText} object to be decrypted. + * @return The {@code PlainText} object resulting from decrypting the specified + * ciphertext. Note that if it is desired to convert the returned + * plaintext byte array to a Java String it should be done using + * {@code new String(byte[], "UTF-8");} rather than simply using + * {@code new String(byte[]);} which uses native encoding and may + * not be portable across hardware and/or OS platforms. + * @throws EncryptionException Thrown if something should go wrong such as + * the JCE provider cannot be found, the cipher algorithm, + * cipher mode, or padding scheme not being supported, specifying + * an unsupported key size, or incorrect encryption key was + * specified or a {@code PaddingException} occurs. + * @see #decrypt(SecretKey, CipherText) + */ + PlainText decrypt(CipherText ciphertext) throws EncryptionException; + + /** + * Decrypts the provided {@link CipherText} using the information from it + * and the specified secret key. + *+ * This decrypt method is similar to {@link #decrypt(CipherText)} except that + * it allows decrypting with a secret key other than the master secret key. + *
+ * @param key The {@code SecretKey} to use for encrypting the plaintext. + * @param ciphertext The {@code CipherText} object to be decrypted. + * @return The {@code PlainText} object resulting from decrypting the specified + * ciphertext. Note that if it is desired to convert the returned + * plaintext byte array to a Java String it should be done using + * {@code new String(byte[], "UTF-8");} rather than simply using + * {@code new String(byte[]);} which uses native encoding and may + * not be portable across hardware and/or OS platforms. + * @throws EncryptionException Thrown if something should go wrong such as + * the JCE provider cannot be found, the cipher algorithm, + * cipher mode, or padding scheme not being supported, specifying + * an unsupported key size, or incorrect encryption key was + * specified or a {@code PaddingException} occurs. + * @see #decrypt(CipherText) + */ + PlainText decrypt(SecretKey key, CipherText ciphertext) throws EncryptionException; + + /** + * Create a digital signature for the provided data and return it in a + * string. + *+ * Limitations: A new public/private key pair used for ESAPI 2.0 digital + * signatures with this method and {@link #verifySignature(String, String)} + * are dynamically created when the default reference implementation class, + * {@link org.owasp.esapi.reference.crypto.JavaEncryptor} is first created. + * Because this key pair is not persisted nor is the public key shared, + * this method and the corresponding {@link #verifySignature(String, String)} + * can not be used with expected results across JVM instances. This limitation + * will be addressed in ESAPI 2.1. + *
+ * + * @param data + * the data to sign + * + * @return + * the digital signature stored as a String + * + * @throws EncryptionException + * if the specified signature algorithm cannot be found + */ + String sign(String data) throws EncryptionException; + + /** + * Verifies a digital signature (created with the sign method) and returns + * the boolean result. + *+ * Limitations: A new public/private key pair used for ESAPI 2.0 digital + * signatures with this method and {@link #sign(String)} + * are dynamically created when the default reference implementation class, + * {@link org.owasp.esapi.reference.crypto.JavaEncryptor} is first created. + * Because this key pair is not persisted nor is the public key shared, + * this method and the corresponding {@link #sign(String)} + * can not be used with expected results across JVM instances. This limitation + * will be addressed in ESAPI 2.1. + *
+ * @param signature + * the signature to verify against 'data' + * @param data + * the data to verify against 'signature' + * + * @return + * true, if the signature is verified, false otherwise + */ + boolean verifySignature(String signature, String data); + + /** + * Creates a seal that binds a set of data and includes an expiration timestamp. + * + * @param data + * the data to seal + * @param timestamp + * the absolute expiration date of the data, expressed as seconds since the epoch + * + * @return + * the seal + * + * @throws IntegrityException + */ + String seal(String data, long timestamp) throws IntegrityException; + + /** + * Unseals data (created with the seal method) and throws an exception + * describing any of the various problems that could exist with a seal, such + * as an invalid seal format, expired timestamp, or decryption error. + * + * @param seal + * the sealed data + * + * @return + * the original (unsealed) data + * + * @throws EncryptionException + * if the unsealed data cannot be retrieved for any reason + */ + String unseal( String seal ) throws EncryptionException; + + /** + * Verifies a seal (created with the seal method) and throws an exception + * describing any of the various problems that could exist with a seal, such + * as an invalid seal format, expired timestamp, or data mismatch. + * + * @param seal + * the seal to verify + * + * @return + * true, if the seal is valid. False otherwise + */ + boolean verifySeal(String seal); + + /** + * Gets an absolute timestamp representing an offset from the current time to be used by + * other functions in the library. + * + * @param offset + * the offset to add to the current time + * + * @return + * the absolute timestamp + */ + long getRelativeTimeStamp( long offset ); + + /** + * Gets a timestamp representing the current date and time to be used by + * other functions in the library. + * + * @return + * a timestamp representing the current time + */ + long getTimeStamp(); + +} \ No newline at end of file diff --git a/src/main/java/org/owasp/esapi/ExecuteResult.java b/src/main/java/org/owasp/esapi/ExecuteResult.java new file mode 100644 index 000000000..6887b80c1 --- /dev/null +++ b/src/main/java/org/owasp/esapi/ExecuteResult.java @@ -0,0 +1,75 @@ +/** + * OWASP Enterprise Security API (ESAPI) + * + * This file is part of the Open Web Application Security Project (OWASP) + * Enterprise Security API (ESAPI) project. For details, please see + * http://www.owasp.org/index.php/ESAPI. + * + * Copyright (c) 2010 - The OWASP Foundation + * + * The ESAPI is published by OWASP under the BSD license. You should read and accept the + * LICENSE before you use, modify, and/or redistribute this software. + * + * @author Patrick Higgins + * @created 2010 + */ +package org.owasp.esapi; + +/** + * The ExecuteResult class encapsulates the pieces of data that can be returned + * from a process executed by the Executor interface. + * + * This class is immutable for thread-safety. + * + * @author Patrick Higgins + * @since Aug 25, 2010 + */ +public class ExecuteResult { + + private final int exitValue; + private final String output; + private final String errors; + + /** + * Constructs an ExecuteResult from the given values. + * + * @param exitValue + * the code from java.lang.Process.exitValue() + * @param output + * the contents read from java.lang.Process.getInputStream() + * @param errors + * the contents read from java.lang.Process.getErrorStream() + */ + public ExecuteResult(int exitValue, String output, String errors) { + this.exitValue = exitValue; + this.output = output; + this.errors = errors; + } + + /** + * @return the code from java.lang.Process.exitValue() + */ + public int getExitValue() { + return exitValue; + } + + /** + * @return the contents read from java.lang.Process.getInputStream() + */ + public String getOutput() { + return output; + } + + /** + * @return the contents read from java.lang.Process.getErrorStream() + */ + public String getErrors() { + return errors; + } + + @Override + public String toString() { + return "ExecuteResult[exitValue="+exitValue+",output="+output+",errors="+errors+"]"; + } + +} diff --git a/src/main/java/org/owasp/esapi/Executor.java b/src/main/java/org/owasp/esapi/Executor.java new file mode 100644 index 000000000..122dcdb94 --- /dev/null +++ b/src/main/java/org/owasp/esapi/Executor.java @@ -0,0 +1,78 @@ +/** + * OWASP Enterprise Security API (ESAPI) + * + * This file is part of the Open Web Application Security Project (OWASP) + * Enterprise Security API (ESAPI) project. For details, please see + * http://www.owasp.org/index.php/ESAPI. + * + * Copyright (c) 2007 - The OWASP Foundation + * + * The ESAPI is published by OWASP under the BSD license. You should read and accept the + * LICENSE before you use, modify, and/or redistribute this software. + * + * @author Jeff Williams Aspect Security + * @created 2007 + */ +package org.owasp.esapi; + +import java.io.File; +import java.util.List; + +import org.owasp.esapi.codecs.Codec; +import org.owasp.esapi.errors.ExecutorException; + +/** + * The Executor interface is used to run an OS command with reduced security risk. + * + *Implementations should do as much as possible to minimize the risk of + * injection into either the command or parameters. In addition, implementations + * should timeout after a specified time period in order to help prevent denial + * of service attacks.
+ * + *The class should perform logging and error handling as + * well. Finally, implementation should handle errors and generate an + * ExecutorException with all the necessary information.
+ * + *The reference implementation does all of the above.
+ * + * @author Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security + * @since June 1, 2007 + */ +public interface Executor { + + /** + * Invokes the specified executable with default workdir and codec and not logging parameters. + * + * @param executable + * the command to execute + * @param params + * the parameters of the command being executed + */ + ExecuteResult executeSystemCommand(File executable, List params) throws ExecutorException; + + /** + * Executes a system command after checking that the executable exists and + * escaping all the parameters to ensure that injection is impossible. + * Implementations must change to the specified working + * directory before invoking the command. + * + * @param executable + * the command to execute + * @param params + * the parameters of the command being executed + * @param workdir + * the working directory + * @param codec + * the codec to use to encode for the particular OS in use + * @param logParams + * use false if any parameters contains sensitive or confidential information + * + * @return the output of the command being run + * + * @throws ExecutorException + * the service exception + */ + ExecuteResult executeSystemCommand(File executable, List params, File workdir, Codec codec, boolean logParams, boolean redirectErrorStream) throws ExecutorException; + +} diff --git a/src/main/java/org/owasp/esapi/HTTPUtilities.java b/src/main/java/org/owasp/esapi/HTTPUtilities.java new file mode 100644 index 000000000..582f1a1b7 --- /dev/null +++ b/src/main/java/org/owasp/esapi/HTTPUtilities.java @@ -0,0 +1,750 @@ +/** + * OWASP Enterprise Security API (ESAPI) + * + * This file is part of the Open Web Application Security Project (OWASP) + * Enterprise Security API (ESAPI) project. For details, please see + * http://www.owasp.org/index.php/ESAPI. + * + * Copyright (c) 2007-2019 - The OWASP Foundation + * + * The ESAPI is published by OWASP under the BSD license. You should read and accept the + * LICENSE before you use, modify, and/or redistribute this software. + * + * @author Jeff Williams Aspect Security + * @created 2007 + */ +package org.owasp.esapi; + +import org.owasp.esapi.errors.*; + +import javax.servlet.ServletException; +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; +import java.io.File; +import java.io.IOException; +import java.util.List; +import java.util.Map; + +/** + * The HTTPUtilities interface is a collection of methods that provide additional security related to HTTP requests, + * responses, sessions, cookies, headers, and logging. + *+ * Note: This most of the methods in this interface NOT compatible with the Jakarta Servlet API Spec 5.0 or later, which + * uses the jakarta.servlet package namespace rather than the javax.servlet package namespace. For further details, + * please see the GitHub Discussion issue + * Add support for Jakarta Servlet API Specification #768. + *
+ * @author Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security + * @since June 1, 2007 + */ +public interface HTTPUtilities +{ + // All implied static final as this is an interface + String REMEMBER_TOKEN_COOKIE_NAME = "rtoken"; + int MAX_COOKIE_LEN = 4096; // From RFC 2109 + int MAX_COOKIE_PAIRS = 20; // From RFC 2109 + String CSRF_TOKEN_NAME = "ctoken"; + String ESAPI_STATE = "estate"; + + int PARAMETER = 0; + int HEADER = 1; + int COOKIE = 2; + + /** + * Calls addCookie with the *current* request. + * + * @param cookie The cookie to add + * + * @see HTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse) + */ + void addCookie(Cookie cookie); + + /** + * Add a cookie to the response after ensuring that there are no encoded or + * illegal characters in the name and name and value. This method also sets + * the secure and HttpOnly flags on the cookie. + * + * @param response The HTTP response to add the cookie to + * @param cookie The cookie to add + */ + void addCookie(HttpServletResponse response, Cookie cookie); + + /** + * Adds the current user's CSRF token (see User.getCSRFToken()) to the URL for purposes of preventing CSRF attacks. + * This method should be used on all URLs to be put into all links and forms the application generates. + * + * @param href the URL to which the CSRF token will be appended + * @return the updated URL with the CSRF token parameter added + */ + String addCSRFToken(String href); + + /** + * Calls addHeader with the *current* request. + * + * @see HTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse) + */ + void addHeader(String name, String value); + + /** + * Add a header to the response after ensuring that there are no encoded or + * illegal characters in the name and name and value. This implementation + * follows the following recommendation: "A recipient MAY replace any linear + * white space with a single SP before interpreting the field value or + * forwarding the message downstream." + * http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html#sec2.2 + * + * @param name + * @param value + */ + void addHeader(HttpServletResponse response, String name, String value); + + /** + * Calls assertSecureRequest with the *current* request. + * @see HTTPUtilities#assertSecureRequest(HttpServletRequest) + * @see HTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse) + */ + void assertSecureRequest() throws AccessControlException; + + /** + * Calls assertSecureChannel with the *current* request. + * @see HTTPUtilities#assertSecureChannel(HttpServletRequest) + * @see HTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse) + */ + void assertSecureChannel() throws AccessControlException; + + /** + * Ensures that the request uses both SSL and POST to protect any sensitive parameters + * in the querystring from being sniffed, logged, bookmarked, included in referer header, etc... + * This method should be called for any request that contains sensitive data from a web form. + * + * @param request + * @throws AccessControlException if security constraints are not met + */ + void assertSecureRequest(HttpServletRequest request) throws AccessControlException; + + /** + * Ensures the use of SSL to protect any sensitive parameters in the request and + * any sensitive data in the response. This method should be called for any request + * that contains sensitive data from a web form or will result in sensitive data in the + * response page. + * + * @param request + * @throws AccessControlException if security constraints are not met + */ + void assertSecureChannel(HttpServletRequest request) throws AccessControlException; + + /** + * Calls changeSessionIdentifier with the *current* request. + * + * @see HTTPUtilities#setCurrentHTTP(HttpServletRequest, HttpServletResponse) + */ + HttpSession changeSessionIdentifier() throws AuthenticationException; + + /** + * Invalidate the existing session after copying all of its contents to a newly created session with a new session id. + * Note that this is different from logging out and creating a new session identifier that does not contain the + * existing session contents. Care should be taken to use this only when the existing session does not contain + * hazardous contents. + * + * @param request + * @return the new HttpSession with a changed id + * @throws AuthenticationException the exception + */ + HttpSession changeSessionIdentifier(HttpServletRequest request) throws AuthenticationException; + + /** + * Clears the current HttpRequest and HttpResponse associated with the current thread. + * + * @see ESAPI#clearCurrent() + */ + void clearCurrent(); + + /** + * Decrypts an encrypted hidden field value and returns the cleartext. If the field does not decrypt properly, + * an IntrusionException is thrown to indicate tampering. + * + * @param encrypted hidden field value to decrypt + * @return decrypted hidden field value stored as a String + */ + String decryptHiddenField(String encrypted); + + /** + * Takes an encrypted querystring and returns a Map containing the original parameters. + * + * @param encrypted the encrypted querystring to decrypt + * @return a Map object containing the decrypted querystring + * @throws EncryptionException + */ + Map+ * This method uses {@link HTTPUtilities#getCurrentRequest()} to obtain the + * {@link javax.servlet.http.HttpServletRequest HttpServletRequest} + * object. If the ESAPI property HttpUtilities.FileUploadAllowAnonymousUser is set to {@code false} (the + * default is {@code true}), then {@code getFileUploads} will call {@code ESAPI.authenticator().getCurrentUser()} + * to check if the user is authenticated. If that property is set to {@code false} and a call to that function returns + * an anonymous (i.e., unauthenticated) user, then the file upload is blocked. + *
+ * ESAPI properties relevant to this and the other {@code getFileUploads} methods referenced in this table. The + * last 2 properties are new since release 2.5.2.0: + *
| ESAPI Property Name | + *ESAPI.properties Default | + *Builtin Default | + *Meaning | + *
|---|---|---|---|
| HttpUtilities.UploadDir | + *C:\ESAPI\testUpload | + *UploadDir | + *Final destination directory for uploaded files. | + *
| HttpUtilities.UploadTempDir | + *C:\temp | + *Value of system property java.io.tmpdir | + *Temporary staging directory for uploaded files. | + *
| HttpUtilities.ApprovedUploadExtensions | + *.pdf,.doc,.docx,.ppt,.pptx,.xls,.xlsx,.rtf,.txt,.jpg,.pn | + *.pdf,.txt,.jpg,.png | + *Comma separated allowed list of file suffixes that may be uploaded. | + *
| HttpUtilities.MaxUploadFileBytes | + *5000000 | + *5000000 | + *Total maximum upload file size for uploaded files per HTTP request. | + *
| HttpUtilities.MaxUploadFileCount | + *20 | + *20 | + *Maximum total number of uploaded files per HTTP request. | + *
| HttpUtilities.FileUploadAllowAnonymousUser | + *true | + *true | + *Controls whether anonymous (i.e., unauthenticated) users may upload files. | + *
+ * As alluded to above, it is important to note that these {@code getFileUploads} methods do not do + * everything to keey your application and environment secure. Some of the more obvious omissions are the + * absence of examining the actual file content to determine the actual file type or running some AV scan + * on the uploaded files. You have to add that functionality to you if you want or need that. Some + * resource that you may find useful are: + *
-
+ *
- OWASP File Upload Cheat Sheet + *
- OWASP Denial of Service Cheat Sheet + *
- Apache Tika - a content analysis toolkit + *
+ * Cache-Control: no-store+ * + * Note that the header "pragma: no-cache" is intended only for use in HTTP requests, not HTTP responses. However, Microsoft has chosen to + * directly violate the standards, so we need to include that header here. For more information, please refer to the relevant standards: + *
+ * Cache-Control: no-cache
+ * Cache-Control: must-revalidate
+ * Expires: -1
+ *
-
+ *
- HTTP/1.1 Cache-Control "no-cache" + *
- HTTP/1.1 Cache-Control "no-store" + *
- HTTP/1.0 Pragma "no-cache" + *
- HTTP/1.0 Expires + *
- IE6 Caching Issues + *
- Microsoft directly violates specification for pragma: no-cache + *
- Firefox browser.cache.disk_cache_ssl + *
- Mozilla + *
+ * The interface is currently designed to accept exceptions as well as custom events. Implementations can use this
+ * stream of information to detect both normal and abnormal behavior.
+ *
+ * @author Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security
+ * @since June 1, 2007
+ */
+public interface IntrusionDetector {
+
+ /**
+ * Adds the exception to the IntrusionDetector. This method should immediately log the exception so that developers throwing an
+ * IntrusionException do not have to remember to log every error. The implementation should store the exception somewhere for the current user
+ * in order to check if the User has reached the threshold for any Enterprise Security Exceptions. The User object is the recommended location for storing
+ * the current user's security exceptions. If the User has reached any security thresholds, the appropriate security action can be taken and logged.
+ *
+ * @param exception
+ * the exception thrown
+ *
+ * @throws IntrusionException
+ * the intrusion exception
+ */
+ void addException(Exception exception) throws IntrusionException;
+
+ /**
+ * Adds the event to the IntrusionDetector. This method should immediately log the event. The implementation should store the event somewhere for the current user
+ * in order to check if the User has reached the threshold for any Enterprise Security Exceptions. The User object is the recommended location for storing
+ * the current user's security event. If the User has reached any security thresholds, the appropriate security action can be taken and logged.
+ *
+ * @param eventName
+ * the event to add
+ * @param logMessage
+ * the message to log with the event
+ *
+ * @throws IntrusionException
+ * the intrusion exception
+ */
+ void addEvent(String eventName, String logMessage) throws IntrusionException;
+
+}
diff --git a/src/main/java/org/owasp/esapi/LogFactory.java b/src/main/java/org/owasp/esapi/LogFactory.java
new file mode 100644
index 000000000..7571ea460
--- /dev/null
+++ b/src/main/java/org/owasp/esapi/LogFactory.java
@@ -0,0 +1,60 @@
+/**
+ * OWASP Enterprise Security API (ESAPI)
+ *
+ * This file is part of the Open Web Application Security Project (OWASP)
+ * Enterprise Security API (ESAPI) project. For details, please see
+ * http://www.owasp.org/index.php/ESAPI.
+ *
+ * Copyright (c) 2007 - The OWASP Foundation
+ *
+ * The ESAPI is published by OWASP under the BSD license. You should read and accept the
+ * LICENSE before you use, modify, and/or redistribute this software.
+ *
+ * @author Rogan DawesAspect Security
+ * @created 2008
+ */
+package org.owasp.esapi;
+
+/**
+ * The LogFactory interface is intended to allow substitution of various logging packages, while providing
+ * a common interface to access them.
+ *
+ * In the reference implementation, JavaLogFactory.java implements this interface. JavaLogFactory.java also contains an
+ * inner class called JavaLogger which implements Logger.java and uses the Java logging package to log events.
+ *
+ * @see org.owasp.esapi.ESAPI
+ *
+ * @author rdawes
+ *
+ */
+public interface LogFactory {
+
+ /**
+ * Gets the logger associated with the specified module name. The module name is used by the logger to log which
+ * module is generating the log events. The implementation of this method should return any preexisting Logger
+ * associated with this module name, rather than creating a new Logger.
+ *
+ * The JavaLogFactory reference implementation meets these requirements.
+ *
+ * @param moduleName
+ * The name of the module requesting the logger.
+ * @return
+ * The Logger associated with this module.
+ */
+ Logger getLogger(String moduleName);
+
+ /**
+ * Gets the logger associated with the specified class. The class is used by the logger to log which
+ * class is generating the log events. The implementation of this method should return any preexisting Logger
+ * associated with this class name, rather than creating a new Logger.
+ *
+ * The JavaLogFactory reference implementation meets these requirements.
+ *
+ * @param clazz
+ * The name of the class requesting the logger.
+ * @return
+ * The Logger associated with this class.
+ */
+ Logger getLogger(Class clazz);
+
+}
diff --git a/src/main/java/org/owasp/esapi/Logger.java b/src/main/java/org/owasp/esapi/Logger.java
new file mode 100644
index 000000000..b0a5b7ccc
--- /dev/null
+++ b/src/main/java/org/owasp/esapi/Logger.java
@@ -0,0 +1,433 @@
+/**
+ * OWASP Enterprise Security API (ESAPI)
+ *
+ * This file is part of the Open Web Application Security Project (OWASP)
+ * Enterprise Security API (ESAPI) project. For details, please see
+ * http://www.owasp.org/index.php/ESAPI.
+ *
+ * Copyright (c) 2007-2019 - The OWASP Foundation
+ *
+ * The ESAPI is published by OWASP under the BSD license. You should read and accept the
+ * LICENSE before you use, modify, and/or redistribute this software.
+ *
+ * @author Jeff Williams Aspect Security
+ * @created 2007
+ */
+package org.owasp.esapi;
+
+/**
+ * The {@code Logger} interface defines a set of methods that can be used to log
+ * security events. It supports a hierarchy of logging levels which can be configured at runtime to determine
+ * the severity of events that are logged, and those below the current threshold that are discarded.
+ * Implementors should use a well established logging library
+ * as it is quite difficult to create a high-performance logger.
+ *
+ * The logging levels defined by this interface (in descending order) are: + *
-
+ *
- fatal (highest value) + *
- error + *
- warning + *
- info + *
- debug + *
- trace (lowest value) + *
+ * ESAPI also allows for the definition of the type of log event that is being generated. + * The {@code Logger} interface predefines 6 types of Log events: + *
-
+ *
- SECURITY_SUCCESS + *
- SECURITY_FAILURE + *
- SECURITY_AUDIT + *
- EVENT_SUCCESS + *
- EVENT_FAILURE + *
- EVENT_UNSPECIFIED + *
+ * Your custom implementation can extend or change this list if desired. + *
+ * This {@code Logger} allows callers to determine which logging levels are enabled, and to submit events
+ * at different severity levels.
+ *
Implementors of this interface should:
+ *
+ *
-
+ *
- Provide a mechanism for setting the logging level threshold that is currently enabled. This usually works by logging all + * events at and above that severity level, and discarding all events below that level. + * This is usually done via configuration, but can also be made accessible programmatically. + *
- Ensure that dangerous HTML characters are encoded before they are logged to defend against malicious injection into logs + * that might be viewed in an HTML based log viewer. + *
- Encode any CRLF characters included in log data in order to prevent log injection attacks. + *
- Avoid logging the user's session ID. Rather, they should log something equivalent like a + * generated logging session ID, or a hashed value of the session ID so they can track session specific + * events without risking the exposure of a live session's ID. + *
- Record the following information with each event: + *
- Identity of the user that caused the event. + *
- A description of the event (supplied by the caller). + *
- Whether the event succeeded or failed (indicated by the caller). + *
- Severity level of the event (indicated by the caller). + *
- That this is a security relevant event (indicated by the caller). + *
- Hostname or IP where the event occurred (and ideally the user's source IP as well). + *
- A date/time stamp. + *
-
+ *
-
+ *
- Filter out any sensitive data specific to the current application or organization, such as credit cards, + * social security numbers, etc. + *
+ * The {@code org.owasp.esapi.logging.java.JavaLogger} class uses the {@code java.util.logging} package as + * the basis for its logging implementation. Both provided implementations implement requirements #1 through #5 above. + *
+ * Customization: It is expected that most organizations may wish to implement their own custom {@code Logger} class in
+ * order to integrate ESAPI logging with their specific logging infrastructure. The ESAPI reference implementations
+ * can serve as a useful starting point to intended to provide a simple functional example of an implementation, but
+ * they are also largely usable out-of-the-box with some additional minimal log configuration.
+ *
+ * @author Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security
+ * @since June 1, 2007
+ */
+public interface Logger {
+
+ // All implied static final as this is an interface
+
+ /**
+ * A security type of log event that has succeeded. This is one of 6 predefined
+ * ESAPI logging events. New events can be added.
+ */
+ EventType SECURITY_SUCCESS = new EventType( "SECURITY SUCCESS", true);
+
+ /**
+ * A security type of log event that has failed. This is one of 6 predefined
+ * ESAPI logging events. New events can be added.
+ */
+ EventType SECURITY_FAILURE = new EventType( "SECURITY FAILURE", false);
+
+ /**
+ * A security type of log event that is associated with an audit trail of some type,
+ * but the log event is not specifically something that has either succeeded or failed
+ * or that is irrelevant in the case of this logged message.
+ */
+ // CHECKME: Should the Boolean for this be 'null' or 'true'? See EVENT_UNSPECIFIED.
+ EventType SECURITY_AUDIT = new EventType( "SECURITY AUDIT", null);
+
+ /**
+ * A non-security type of log event that has succeeded. This is one of 6 predefined
+ * ESAPI logging events. New events can be added.
+ */
+ EventType EVENT_SUCCESS = new EventType( "EVENT SUCCESS", true);
+
+ /**
+ * A non-security type of log event that has failed. This is one of 6 predefined
+ * ESAPI logging events. New events can be added.
+ */
+ EventType EVENT_FAILURE = new EventType( "EVENT FAILURE", false);
+
+ /**
+ * A non-security type of log event that is unspecified. This is one of 6 predefined
+ * ESAPI logging events. New events can be added.
+ */
+ EventType EVENT_UNSPECIFIED = new EventType( "EVENT UNSPECIFIED", null);
+
+ /**
+ * Defines the type of log event that is being generated. The Logger interface defines 6 types of Log events:
+ * SECURITY_SUCCESS, SECURITY_FAILURE, EVENT_SUCCESS, EVENT_FAILURE, EVENT_UNSPECIFIED.
+ * Your implementation can extend or change this list if desired.
+ */
+ class EventType {
+
+ private String type;
+ private Boolean success = null;
+
+ public EventType (String name, Boolean newSuccess) {
+ this.type = name;
+ this.success = newSuccess;
+ }
+
+ public Boolean isSuccess() {
+ return success;
+ }
+
+ /**
+ * Convert the {@code EventType} to a string.
+ * @return The event type name.
+ */
+ @Override
+ public String toString() {
+ return this.type;
+ }
+ }
+
+ /*
+ * The Logger interface defines 6 logging levels: FATAL, ERROR, WARNING, INFO, DEBUG, TRACE. It also
+ * supports ALL, which logs all events, and OFF, which disables all logging.
+ * Your implementation can extend or change this list if desired.
+ */
+
+ /** OFF indicates that no messages should be logged. This level is initialized to Integer.MAX_VALUE. */
+ int OFF = Integer.MAX_VALUE;
+
+ /** FATAL indicates that only FATAL messages should be logged. This level is initialized to 1000. */
+ int FATAL = 1000;
+
+ /** ERROR indicates that ERROR messages and above should be logged.
+ * This level is initialized to 800. */
+ int ERROR = 800;
+
+ /** WARNING indicates that WARNING messages and above should be logged.
+ * This level is initialized to 600. */
+ int WARNING = 600;
+
+ /** INFO indicates that INFO messages and above should be logged.
+ * This level is initialized to 400. */
+ int INFO = 400;
+
+ /** DEBUG indicates that DEBUG messages and above should be logged.
+ * This level is initialized to 200. */
+ int DEBUG = 200;
+
+ /** TRACE indicates that TRACE messages and above should be logged.
+ * This level is initialized to 100. */
+ int TRACE = 100;
+
+ /** ALL indicates that all messages should be logged. This level is initialized to Integer.MIN_VALUE. */
+ int ALL = Integer.MIN_VALUE;
+
+
+ /**
+ * Dynamically set the ESAPI logging severity level. All events of this level and higher will be logged from
+ * this point forward for all logs. All events below this level will be discarded.
+ *
+ * @param level The level to set the logging level to.
+ */
+ void setLevel(int level);
+
+ /** Retrieve the current ESAPI logging level for this logger.
+ *
+ * @return The current logging level.
+ */
+ int getESAPILevel();
+
+ /**
+ * Log a fatal event if 'fatal' level logging is enabled.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ */
+ void fatal(EventType type, String message);
+
+ /**
+ * Log a fatal level security event if 'fatal' level logging is enabled
+ * and also record the stack trace associated with the event.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ * @param throwable
+ * the exception to be logged
+ */
+ void fatal(EventType type, String message, Throwable throwable);
+
+ /**
+ * Allows the caller to determine if messages logged at this level
+ * will be discarded, to avoid performing expensive processing.
+ *
+ * @return true if fatal level messages will be output to the log
+ */
+ boolean isFatalEnabled();
+
+ /**
+ * Log an error level security event if 'error' level logging is enabled.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ */
+ void error(EventType type, String message);
+
+ /**
+ * Log an error level security event if 'error' level logging is enabled
+ * and also record the stack trace associated with the event.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ * @param throwable
+ * the exception to be logged
+ */
+ void error(EventType type, String message, Throwable throwable);
+
+ /**
+ * Allows the caller to determine if messages logged at this level
+ * will be discarded, to avoid performing expensive processing.
+ *
+ * @return true if error level messages will be output to the log
+ */
+ boolean isErrorEnabled();
+
+ /**
+ * Log a warning level security event if 'warning' level logging is enabled.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ */
+ void warning(EventType type, String message);
+
+ /**
+ * Log a warning level security event if 'warning' level logging is enabled
+ * and also record the stack trace associated with the event.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ * @param throwable
+ * the exception to be logged
+ */
+ void warning(EventType type, String message, Throwable throwable);
+
+ /**
+ * Allows the caller to determine if messages logged at this level
+ * will be discarded, to avoid performing expensive processing.
+ *
+ * @return true if warning level messages will be output to the log
+ */
+ boolean isWarningEnabled();
+
+ /**
+ * Log an info level security event if 'info' level logging is enabled.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ */
+ void info(EventType type, String message);
+
+ /**
+ * Log an info level security event if 'info' level logging is enabled
+ * and also record the stack trace associated with the event.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ * @param throwable
+ * the exception to be logged
+ */
+ void info(EventType type, String message, Throwable throwable);
+
+ /**
+ * Allows the caller to determine if messages logged at this level
+ * will be discarded, to avoid performing expensive processing.
+ *
+ * @return true if info level messages will be output to the log
+ */
+ boolean isInfoEnabled();
+
+ /**
+ * Log a debug level security event if 'debug' level logging is enabled.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ */
+ void debug(EventType type, String message);
+
+ /**
+ * Log a debug level security event if 'debug' level logging is enabled
+ * and also record the stack trace associated with the event.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ * @param throwable
+ * the exception to be logged
+ */
+ void debug(EventType type, String message, Throwable throwable);
+
+ /**
+ * Allows the caller to determine if messages logged at this level
+ * will be discarded, to avoid performing expensive processing.
+ *
+ * @return true if debug level messages will be output to the log
+ */
+ boolean isDebugEnabled();
+
+ /**
+ * Log a trace level security event if 'trace' level logging is enabled.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ */
+ void trace(EventType type, String message);
+
+ /**
+ * Log a trace level security event if 'trace' level logging is enabled
+ * and also record the stack trace associated with the event.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ * @param throwable
+ * the exception to be logged
+ */
+ void trace(EventType type, String message, Throwable throwable);
+
+ /**
+ * Allows the caller to determine if messages logged at this level
+ * will be discarded, to avoid performing expensive processing.
+ *
+ * @return true if trace level messages will be output to the log
+ */
+ boolean isTraceEnabled();
+
+ /**
+ * Log an event regardless of what logging level is enabled.
+ *
+ * Note that logging will not occur if the underlying logging implementation has logging disabled.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ */
+ void always(EventType type, String message);
+
+ /**
+ * Log an event regardless of what logging level is enabled
+ * and also record the stack trace associated with the event.
+ *
+ * Note that logging will not occur if the underlying logging implementation has logging disabled.
+ *
+ * @param type
+ * the type of event
+ * @param message
+ * the message to log
+ * @param throwable
+ * the exception to be logged
+ */
+ void always(EventType type, String message, Throwable throwable);
+}
diff --git a/src/main/java/org/owasp/esapi/PreparedString.java b/src/main/java/org/owasp/esapi/PreparedString.java
new file mode 100644
index 000000000..5102a324c
--- /dev/null
+++ b/src/main/java/org/owasp/esapi/PreparedString.java
@@ -0,0 +1,137 @@
+/**
+ * OWASP Enterprise Security API (ESAPI)
+ *
+ * This file is part of the Open Web Application Security Project (OWASP)
+ * Enterprise Security API (ESAPI) project. For details, please see
+ * http://www.owasp.org/index.php/ESAPI.
+ *
+ * Copyright (c) 2007-2019 - The OWASP Foundation
+ *
+ * The ESAPI is published by OWASP under the BSD license. You should read and accept the
+ * LICENSE before you use, modify, and/or redistribute this software.
+ *
+ * @author Jeff Williams Aspect Security
+ * @created 2009
+ */
+package org.owasp.esapi;
+
+import java.util.ArrayList;
+import org.owasp.esapi.codecs.Codec;
+
+/**
+ * A parameterized string that uses escaping to make untrusted data safe before combining it with
+ * a command or query intended for use in an interpreter.
+ *
+ * PreparedString div = new PreparedString( "<a href=\"http:\\\\example.com?id=?\" onmouseover=\"alert('?')\">test</a>", new HTMLEntityCodec() );
+ * div.setURL( 1, request.getParameter( "url" ), new PercentCodec() );
+ * div.set( 2, request.getParameter( "message" ), new JavaScriptCodec() );
+ * out.println( div.toString() );
+ *
+ * // escaping for SQL
+ * PreparedString query = new PreparedString( "SELECT * FROM users WHERE name='?' AND password='?'", new OracleCodec() );
+ * query.set( 1, request.getParameter( "name" ) );
+ * query.set( 2, request.getParameter( "pass" ) );
+ * stmt.execute( query.toString() );
+ *
+ *
+ * @author Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security
+ * @since June 1, 2007
+ */
+public class PreparedString {
+ char parameterCharacter = '?';
+ Codec codec = null;
+ String[] parameters = null;
+ ArrayList parts = new ArrayList();
+ private final static char[] IMMUNE = {};
+
+ /**
+ * Create a PreparedString with the supplied template and Codec. The template should use the
+ * default parameter placeholder character (?) in the place where actual parameters are to be inserted.
+ * The supplied Codec will be used to escape characters in calls to set, unless a specific Codec is
+ * provided to override it.
+ * @param template
+ * @param codec
+ */
+ public PreparedString( String template, Codec codec ) {
+ this.codec = codec;
+ split( template, parameterCharacter );
+ }
+
+ /**
+ * Create a PreparedString with the supplied template, parameter placeholder character, and Codec. The parameter character
+ * can be any character, but should not be one that will be used in the template. The parameter character can safely
+ * be used in a parameter passed into the set methods.
+ * @param template
+ * @param parameterCharacter
+ * @param codec
+ */
+ public PreparedString( String template, char parameterCharacter, Codec codec ) {
+ this.codec = codec;
+ this.parameterCharacter = parameterCharacter;
+ split( template, parameterCharacter );
+ }
+
+ /**
+ * Split a string with a particular character.
+ * @param str
+ * @param c
+ */
+ private void split( String str, char c ) {
+ int index = 0;
+ int pcount = 0;
+ for ( int i = 0; i < str.length(); i++ ) {
+ if ( str.charAt(i) == c ) {
+ pcount++;
+ parts.add( str.substring(index,i) );
+ index = i + 1;
+ }
+ }
+ parts.add( str.substring(index) );
+ parameters = new String[pcount];
+ }
+
+ /**
+ * Set the parameter at index with supplied value using the default Codec to escape.
+ * @param index
+ * @param value
+ */
+ public void set( int index, String value ) {
+ if ( index < 1 || index > parameters.length ) {
+ throw new IllegalArgumentException( "Attempt to set parameter " + index + " on a PreparedString with only " + parameters.length + " placeholders" );
+ }
+ String encoded = codec.encode( IMMUNE, value );
+ parameters[index-1] = encoded;
+ }
+
+ /**
+ * Set the parameter at index with supplied value using the supplied Codec to escape.
+ * @param index
+ * @param value
+ * @param codec
+ */
+ public void set( int index, String value, Codec codec ) {
+ if ( index < 1 || index > parameters.length ) {
+ throw new IllegalArgumentException( "Attempt to set parameter " + index + " on a PreparedString with only " + parameters.length + " placeholders" );
+ }
+ String encoded = codec.encode( IMMUNE, value );
+ parameters[index-1] = encoded;
+ }
+
+ /**
+ * Render the PreparedString by combining the template with properly escaped parameters.
+ */
+ public String toString() {
+ for ( int ix = 0; ix < parameters.length; ix++ ) {
+ if ( parameters[ix] == null ) {
+ throw new RuntimeException( "Attempt to render PreparedString without setting parameter " + ( ix + 1 ));
+ }
+ }
+ StringBuilder sb = new StringBuilder();
+ int i = 0;
+ for ( int p=0; p < parts.size(); p++ ) {
+ sb.append( parts.get( p ) );
+ if ( i < parameters.length ) sb.append( parameters[i++] );
+ }
+ return sb.toString();
+ }
+}
diff --git a/src/main/java/org/owasp/esapi/PropNames.java b/src/main/java/org/owasp/esapi/PropNames.java
new file mode 100644
index 000000000..8aa4179a9
--- /dev/null
+++ b/src/main/java/org/owasp/esapi/PropNames.java
@@ -0,0 +1,206 @@
+// TODO: Discuss: Should the name of this be PropConstants or PropertConstants
+// since there are some property values included here? I don't
+// really like that as much as PropNames, but I could live with
+// it.
+/*
+ * OWASP Enterprise Security API (ESAPI)
+ *
+ * This file is part of the Open Web Application Security Project (OWASP)
+ * Enterprise Security API (ESAPI) project. For details, please see
+ * https://owasp.org/www-project-enterprise-security-api/.
+ *
+ * Copyright (c) 2022 - The OWASP Foundation
+ *
+ * The ESAPI is published by OWASP under the BSD license. You should read and accept the
+ * LICENSE before you use, modify, and/or redistribute this software.
+ *
+ */
+package org.owasp.esapi;
+
+
+/**
+ * This non-constructable class of public constants defines all the property names used in {@code ESAPI.properties} as
+ * well as some of the default property values for some of those properties. This class is not intended
+ * to be extended or instantiated. Technically, an interface would have worked here, but we
+ * also wanted to be able to prevent 'implements PropNames', which really does not make much
+ * sense since no specific behavior is promised here. Another alternative would have
+ * been to place all of these in the {@code org.owasp.esapi.SecurityConfiguration} interface,
+ * but that interface is already overly bloated. Hence this was decided as a compromise.
+ * + * Note that the constants herein were originally all defined within + * {@code org.owasp.esapi.reference.DefaultSecurityConfiguration}, but those + * values are now marked deprecated and they are candidates for removal 2 years + * from the date of this release. + *
+ * Mostly this is intended to prevent having to hard-code property names all + * over the place in implementation-level classes (e.g., + * {@code org.owasp.esapi.reference.DefaultSecurityConfiguration}). + * It is suggested that this file be used as a 'static import'; + * e.g., + *
+ * import static org.owasp.esapi.PropNames.*; // Import all properties, en masse + * or + * import static org.owasp.esapi.PropNames.SomeSpecificPropName; // Import specific property name + *+ * This can be extremely useful when used with methods such as + * {@code SecurityConfiguration.getIntProp(String propName)}, + * {@code SecurityConfiguration.getBooleanProp(String propName)}, + * {@code SecurityConfiguration.getStringProp(String propName)}, etc. + * + * @author Kevin W. Wall (kevin.w.wall .at. gmail.com) + * @since 2.4.1.0 + * @see org.owasp.esapi.reference.DefaultSecurityConfiguration + */ + +public final class PropNames { + + public static final String REMEMBER_TOKEN_DURATION = "Authenticator.RememberTokenDuration"; + public static final String IDLE_TIMEOUT_DURATION = "Authenticator.IdleTimeoutDuration"; + public static final String ABSOLUTE_TIMEOUT_DURATION = "Authenticator.AbsoluteTimeoutDuration"; + public static final String ALLOWED_LOGIN_ATTEMPTS = "Authenticator.AllowedLoginAttempts"; + public static final String USERNAME_PARAMETER_NAME = "Authenticator.UsernameParameterName"; + public static final String PASSWORD_PARAMETER_NAME = "Authenticator.PasswordParameterName"; + public static final String MAX_OLD_PASSWORD_HASHES = "Authenticator.MaxOldPasswordHashes"; + + public static final String ALLOW_MULTIPLE_ENCODING = "Encoder.AllowMultipleEncoding"; + public static final String ALLOW_MIXED_ENCODING = "Encoder.AllowMixedEncoding"; + public static final String CANONICALIZATION_CODECS = "Encoder.DefaultCodecList"; + + public static final String DISABLE_INTRUSION_DETECTION = "IntrusionDetector.Disable"; + + public static final String MASTER_KEY = "Encryptor.MasterKey"; + public static final String MASTER_SALT = "Encryptor.MasterSalt"; + public static final String KEY_LENGTH = "Encryptor.EncryptionKeyLength"; + public static final String ENCRYPTION_ALGORITHM = "Encryptor.EncryptionAlgorithm"; + public static final String HASH_ALGORITHM = "Encryptor.HashAlgorithm"; + public static final String HASH_ITERATIONS = "Encryptor.HashIterations"; + public static final String CHARACTER_ENCODING = "Encryptor.CharacterEncoding"; + public static final String RANDOM_ALGORITHM = "Encryptor.RandomAlgorithm"; + public static final String DIGITAL_SIGNATURE_ALGORITHM = "Encryptor.DigitalSignatureAlgorithm"; + public static final String DIGITAL_SIGNATURE_KEY_LENGTH = "Encryptor.DigitalSignatureKeyLength"; + public static final String PREFERRED_JCE_PROVIDER = "Encryptor.PreferredJCEProvider"; + public static final String CIPHER_TRANSFORMATION_IMPLEMENTATION = "Encryptor.CipherTransformation"; + public static final String CIPHERTEXT_USE_MAC = "Encryptor.CipherText.useMAC"; + public static final String PLAINTEXT_OVERWRITE = "Encryptor.PlainText.overwrite"; + public static final String IV_TYPE = "Encryptor.ChooseIVMethod"; // Will be removed in future release. + public static final String COMBINED_CIPHER_MODES = "Encryptor.cipher_modes.combined_modes"; + public static final String ADDITIONAL_ALLOWED_CIPHER_MODES = "Encryptor.cipher_modes.additional_allowed"; + public static final String KDF_PRF_ALG = "Encryptor.KDF.PRF"; + public static final String PRINT_PROPERTIES_WHEN_LOADED = "ESAPI.printProperties"; + public static final String ACCEPTED_UNSAFE_METHOD_NAMES = "ESAPI.dangerouslyAllowUnsafeMethods.methodNames"; + public static final String ACCEPTED_UNSAFE_METHODS_JUSTIFICATION = "ESAPI.dangerouslyAllowUnsafeMethods.justification"; + + public static final String WORKING_DIRECTORY = "Executor.WorkingDirectory"; + public static final String APPROVED_EXECUTABLES = "Executor.ApprovedExecutables"; + + public static final String FORCE_HTTPONLYSESSION = "HttpUtilities.ForceHttpOnlySession"; + public static final String FORCE_SECURESESSION = "HttpUtilities.SecureSession"; + public static final String FORCE_HTTPONLYCOOKIES = "HttpUtilities.ForceHttpOnlyCookies"; + public static final String FORCE_SECURECOOKIES = "HttpUtilities.ForceSecureCookies"; + public static final String MAX_HTTP_HEADER_SIZE = "HttpUtilities.MaxHeaderSize"; + public static final String UPLOAD_DIRECTORY = "HttpUtilities.UploadDir"; + public static final String UPLOAD_TEMP_DIRECTORY = "HttpUtilities.UploadTempDir"; + public static final String APPROVED_UPLOAD_EXTENSIONS = "HttpUtilities.ApprovedUploadExtensions"; + public static final String MAX_UPLOAD_FILE_BYTES = "HttpUtilities.MaxUploadFileBytes"; + public static final String MAX_UPLOAD_FILE_COUNT = "HttpUtilities.MaxUploadFileCount"; + public static final String FILEUPLOAD_ALLOW_ANONYMOUS_USERS = "HttpUtilities.FileUploadAllowAnonymousUser"; + public static final String RESPONSE_CONTENT_TYPE = "HttpUtilities.ResponseContentType"; + public static final String HTTP_SESSION_ID_NAME = "HttpUtilities.HttpSessionIdName"; + + public static final String APPLICATION_NAME = "Logger.ApplicationName"; + public static final String LOG_USER_INFO = "Logger.UserInfo"; + public static final String LOG_CLIENT_INFO = "Logger.ClientInfo"; + public static final String LOG_ENCODING_REQUIRED = "Logger.LogEncodingRequired"; + public static final String LOG_APPLICATION_NAME = "Logger.LogApplicationName"; + public static final String LOG_SERVER_IP = "Logger.LogServerIP"; + public static final String LOG_PREFIX = "Logger.LogPrefix"; + + public static final String VALIDATION_PROPERTIES = "Validator.ConfigurationFile"; + public static final String VALIDATION_PROPERTIES_MULTIVALUED = "Validator.ConfigurationFile.MultiValued"; + public static final String ACCEPT_LENIENT_DATES = "Validator.AcceptLenientDates"; + public static final String VALIDATOR_HTML_VALIDATION_ACTION = "Validator.HtmlValidationAction"; + public static final String VALIDATOR_HTML_VALIDATION_CONFIGURATION_FILE = "Validator.HtmlValidationConfigurationFile"; + + /** + * Special {@code java.lang.System} property that, if set to {@code true}, will + * disable logging from {@code DefaultSecurityConfiguration.logToStdout()} + * methods, which is called from various {@code logSpecial()} methods. + * + * @see org.owasp.esapi.reference.DefaultSecurityConfiguration#logToStdout(String msg, Throwable t) + */ + public static final String DISCARD_LOGSPECIAL = "org.owasp.esapi.logSpecial.discard"; + + /* + * Implementation Keys for the various major ESAPI components. + */ + public static final String LOG_IMPLEMENTATION = "ESAPI.Logger"; + public static final String AUTHENTICATION_IMPLEMENTATION = "ESAPI.Authenticator"; + public static final String ENCODER_IMPLEMENTATION = "ESAPI.Encoder"; + public static final String ACCESS_CONTROL_IMPLEMENTATION = "ESAPI.AccessControl"; + public static final String ENCRYPTION_IMPLEMENTATION = "ESAPI.Encryptor"; + public static final String INTRUSION_DETECTION_IMPLEMENTATION = "ESAPI.IntrusionDetector"; + public static final String RANDOMIZER_IMPLEMENTATION = "ESAPI.Randomizer"; + public static final String EXECUTOR_IMPLEMENTATION = "ESAPI.Executor"; + public static final String VALIDATOR_IMPLEMENTATION = "ESAPI.Validator"; + public static final String HTTP_UTILITIES_IMPLEMENTATION = "ESAPI.HTTPUtilities"; + + + ////////////////////////////////////////////////////////////////////////////// + // // + // These are not really property names, but the shouldn't really be in an // + // implementation class that we want to only deal with via the // + // SecurityConfiguration interface. // + // // + ////////////////////////////////////////////////////////////////////////////// + + + /* + * These are default implementation classes. + */ + public static final String DEFAULT_LOG_IMPLEMENTATION = "org.owasp.esapi.logging.java.JavaLogFactory"; + public static final String DEFAULT_AUTHENTICATION_IMPLEMENTATION = "org.owasp.esapi.reference.FileBasedAuthenticator"; + public static final String DEFAULT_ENCODER_IMPLEMENTATION = "org.owasp.esapi.reference.DefaultEncoder"; + public static final String DEFAULT_ACCESS_CONTROL_IMPLEMENTATION = "org.owasp.esapi.reference.DefaultAccessController"; + public static final String DEFAULT_ENCRYPTION_IMPLEMENTATION = "org.owasp.esapi.reference.crypto.JavaEncryptor"; + public static final String DEFAULT_INTRUSION_DETECTION_IMPLEMENTATION = "org.owasp.esapi.reference.DefaultIntrusionDetector"; + public static final String DEFAULT_RANDOMIZER_IMPLEMENTATION = "org.owasp.esapi.reference.DefaultRandomizer"; + public static final String DEFAULT_EXECUTOR_IMPLEMENTATION = "org.owasp.esapi.reference.DefaultExecutor"; + public static final String DEFAULT_HTTP_UTILITIES_IMPLEMENTATION = "org.owasp.esapi.reference.DefaultHTTPUtilities"; + public static final String DEFAULT_VALIDATOR_IMPLEMENTATION = "org.owasp.esapi.reference.DefaultValidator"; + + /** The name of the ESAPI property file */ + public static final String DEFAULT_RESOURCE_FILE = "ESAPI.properties"; + + // + // Private CTOR to prevent creation of PropName objects. We wouldn't need + // this if this were an interface, nor would we need the explict 'public static final'. + // + private PropNames() { + throw new AssertionError("Thought you'd cheat using reflection or JNI, huh? :)"); + } + + + /** Enum used with the search paths used to locate an + * {@code ESAPI.properties} and/or a {@code validation.properties} + * file. + */ + public enum DefaultSearchPath { + + RESOURCE_DIRECTORY("resourceDirectory/"), + SRC_MAIN_RESOURCES("src/main/resources/"), + ROOT(""), + DOT_ESAPI(".esapi/"), + ESAPI("esapi/"), + RESOURCES("resources/"); + + private final String path; + + private DefaultSearchPath(String s){ + this.path = s; + } + + public String value(){ + return path; + } + } +} diff --git a/src/main/java/org/owasp/esapi/Randomizer.java b/src/main/java/org/owasp/esapi/Randomizer.java new file mode 100644 index 000000000..bef0c4a1b --- /dev/null +++ b/src/main/java/org/owasp/esapi/Randomizer.java @@ -0,0 +1,147 @@ +/** + * OWASP Enterprise Security API (ESAPI) + * + * This file is part of the Open Web Application Security Project (OWASP) + * Enterprise Security API (ESAPI) project. For details, please see + * http://www.owasp.org/index.php/ESAPI. + * + * Copyright (c) 2007 - The OWASP Foundation + * + * The ESAPI is published by OWASP under the BSD license. You should read and accept the + * LICENSE before you use, modify, and/or redistribute this software. + * + * @author Jeff Williams Aspect Security + * @created 2007 + */ +package org.owasp.esapi; + +import org.owasp.esapi.errors.EncryptionException; + +/** + * The Randomizer interface defines a set of methods for creating + * cryptographically random numbers and strings. Implementers should be sure to + * use a strong cryptographic implementation, such as the JCE or BouncyCastle. + * Weak sources of randomness can undermine a wide variety of security + * mechanisms. The specific algorithm used is configurable in ESAPI.properties. + * + * @author Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security + * @since June 1, 2007 + */ +public interface Randomizer { + + /** + * Gets a random string of a desired length and character set. The use of java.security.SecureRandom + * is recommended because it provides a cryptographically strong pseudo-random number generator. + * If SecureRandom is not used, the pseudo-random number generator used should comply with the + * statistical random number generator tests specified in + * FIPS 140-2, Security Requirements for Cryptographic Modules, section 4.9.1. + * + * @param length + * the length of the string + * @param characterSet + * the set of characters to include in the created random string + * + * @return + * the random string of the desired length and character set + */ + String getRandomString(int length, char[] characterSet); + + /** + * Returns a random boolean. The use of java.security.SecureRandom + * is recommended because it provides a cryptographically strong pseudo-random number generator. + * If SecureRandom is not used, the pseudo-random number generator used should comply with the + * statistical random number generator tests specified in + * FIPS 140-2, Security Requirements for Cryptographic Modules, section 4.9.1. + * + * @return + * true or false, randomly + */ + boolean getRandomBoolean(); + + /** + * Gets the random integer in the range of [min, max). The use of java.security.SecureRandom + * is recommended because it provides a cryptographically strong pseudo-random number generator. + * If SecureRandom is not used, the pseudo-random number generator used should comply with the + * statistical random number generator tests specified in + * FIPS 140-2, Security Requirements for Cryptographic Modules, section 4.9.1. + * + * @param min + * the minimum integer that will be returned, inclusive + * @param max + * the maximum integer that will be returned, exclusive + * + * @return + * the random integer + */ + int getRandomInteger(int min, int max); + + + /** + * Gets the random long. The use of java.security.SecureRandom + * is recommended because it provides a cryptographically strong pseudo-random number generator. + * If SecureRandom is not used, the pseudo-random number generator used should comply with the + * statistical random number generator tests specified in + * FIPS 140-2, Security Requirements for Cryptographic Modules, section 4.9.1. + * + * @return + * the random long + */ + long getRandomLong(); + + + /** + * Returns an unguessable random filename with the specified extension. This method could call + * getRandomString(length, charset) from this Class with the desired length and alphanumerics as the charset + * then merely append "." + extension. + * + * @param extension + * extension to add to the random filename + * + * @return + * a random unguessable filename ending with the specified extension + */ + String getRandomFilename( String extension ); + + + /** + * Gets the random real in the range of [min, max]. The use of java.security.SecureRandom + * is recommended because it provides a cryptographically strong pseudo-random number generator. + * If SecureRandom is not used, the pseudo-random number generator used should comply with the + * statistical random number generator tests specified in + * FIPS 140-2, Security Requirements for Cryptographic Modules, section 4.9.1. + * + * @param min + * the minimum real number that will be returned, inclusive + * @param max + * the maximum real number that will be returned, inclusive + * + * @return + * the random real + */ + float getRandomReal(float min, float max); + + /** + * Generates a random GUID. This method could use a hash of random Strings, the current time, + * and any other random data available. The format is a well-defined sequence of 32 hex digits + * grouped into chunks of 8-4-4-4-12. + *
+ * For more information including algorithms used to create UUIDs,
+ * see the Internet-Draft UUIDs and GUIDs
+ * or the standards body definition at ISO/IEC 11578:1996.
+ * @return
+ * the GUID
+ *
+ * @throws
+ * EncryptionException if hashing or encryption fails
+ */
+ String getRandomGUID() throws EncryptionException;
+
+ /**
+ * Generates a specified number of random bytes.
+ * @param n The requested number of random bytes.
+ * @return The {@code n} random bytes are returned.
+ */
+ byte[] getRandomBytes(int n);
+
+}
diff --git a/src/main/java/org/owasp/esapi/SafeFile.java b/src/main/java/org/owasp/esapi/SafeFile.java
new file mode 100644
index 000000000..e048e9419
--- /dev/null
+++ b/src/main/java/org/owasp/esapi/SafeFile.java
@@ -0,0 +1,107 @@
+/**
+ * OWASP Enterprise Security API (ESAPI)
+ *
+ * This file is part of the Open Web Application Security Project (OWASP)
+ * Enterprise Security API (ESAPI) project. For details, please see
+ * http://www.owasp.org/index.php/ESAPI.
+ *
+ * Copyright (c) 2008 - The OWASP Foundation
+ *
+ * The ESAPI is published by OWASP under the BSD license. You should read and accept the
+ * LICENSE before you use, modify, and/or redistribute this software.
+ *
+ * @author Arshan Dabirsiaghi Aspect Security
+ * @created 2008
+ */
+package org.owasp.esapi;
+
+import java.io.File;
+import java.net.URI;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import org.owasp.esapi.errors.ValidationException;
+
+/**
+ * Extension to java.io.File to prevent against null byte injections and
+ * other unforeseen problems resulting from unprintable characters
+ * causing problems in path lookups. This does _not_ prevent against
+ * directory traversal attacks.
+ */
+public class SafeFile extends File {
+
+ private static final long serialVersionUID = 1L;
+ private static final Pattern PERCENTS_PAT = Pattern.compile("(%)([0-9a-fA-F])([0-9a-fA-F])");
+ private static final Pattern FILE_BLACKLIST_PAT = Pattern.compile("([\\\\/:*?<>|^])");
+ private static final Pattern DIR_BLACKLIST_PAT = Pattern.compile("([*?<>|^])");
+
+ public SafeFile(String path) throws ValidationException {
+ super(path);
+ doDirCheck(this.getParent());
+ doFileCheck(this.getName());
+ }
+
+ public SafeFile(String parent, String child) throws ValidationException {
+ super(parent, child);
+ doDirCheck(this.getParent());
+ doFileCheck(this.getName());
+ }
+
+ public SafeFile(File parent, String child) throws ValidationException {
+ super(parent, child);
+ doDirCheck(this.getParent());
+ doFileCheck(this.getName());
+ }
+
+ public SafeFile(URI uri) throws ValidationException {
+ super(uri);
+ doDirCheck(this.getParent());
+ doFileCheck(this.getName());
+ }
+
+
+ private void doDirCheck(String path) throws ValidationException {
+ Matcher m1 = DIR_BLACKLIST_PAT.matcher( path );
+ if ( null != m1 && m1.find() ) {
+ throw new ValidationException( "Invalid directory", "Directory path (" + path + ") contains illegal character: " + m1.group() );
+ }
+
+ Matcher m2 = PERCENTS_PAT.matcher( path );
+ if (null != m2 && m2.find() ) {
+ throw new ValidationException( "Invalid directory", "Directory path (" + path + ") contains encoded characters: " + m2.group() );
+ }
+
+ int ch = containsUnprintableCharacters(path);
+ if (ch != -1) {
+ throw new ValidationException("Invalid directory", "Directory path (" + path + ") contains unprintable character: " + ch);
+ }
+ }
+
+ private void doFileCheck(String path) throws ValidationException {
+ Matcher m1 = FILE_BLACKLIST_PAT.matcher( path );
+ if ( m1.find() ) {
+ throw new ValidationException( "Invalid directory", "Directory path (" + path + ") contains illegal character: " + m1.group() );
+ }
+
+ Matcher m2 = PERCENTS_PAT.matcher( path );
+ if ( m2.find() ) {
+ throw new ValidationException( "Invalid file", "File path (" + path + ") contains encoded characters: " + m2.group() );
+ }
+
+ int ch = containsUnprintableCharacters(path);
+ if (ch != -1) {
+ throw new ValidationException("Invalid file", "File path (" + path + ") contains unprintable character: " + ch);
+ }
+ }
+
+ private int containsUnprintableCharacters(String s) {
+ for (int i = 0; i < s.length(); i++) {
+ char ch = s.charAt(i);
+ if (((int) ch) < 32 || ((int) ch) > 126) {
+ return (int) ch;
+ }
+ }
+ return -1;
+ }
+
+}
diff --git a/src/main/java/org/owasp/esapi/SecurityConfiguration.java b/src/main/java/org/owasp/esapi/SecurityConfiguration.java
new file mode 100644
index 000000000..e0b529b49
--- /dev/null
+++ b/src/main/java/org/owasp/esapi/SecurityConfiguration.java
@@ -0,0 +1,767 @@
+/**
+ * OWASP Enterprise Security API (ESAPI)
+ *
+ * This file is part of the Open Web Application Security Project (OWASP)
+ * Enterprise Security API (ESAPI) project. For details, please see
+ * http://www.owasp.org/index.php/ESAPI.
+ *
+ * Copyright (c) 2007 - The OWASP Foundation
+ *
+ * The ESAPI is published by OWASP under the BSD license. You should read and accept the
+ * LICENSE before you use, modify, and/or redistribute this software.
+ *
+ * @author Mike Fauzy Aspect Security
+ * @author Jeff Williams Aspect Security
+ * @created 2007
+ */
+package org.owasp.esapi;
+
+import org.owasp.esapi.configuration.EsapiPropertyLoader;
+
+import java.io.File;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.List;
+import java.util.regex.Pattern;
+
+/**
+ * The {@code SecurityConfiguration} interface stores all configuration information
+ * that directs the behavior of the ESAPI implementation.
+ *
+ * Protection of this configuration information is critical to the secure
+ * operation of the application using the ESAPI. You should use operating system
+ * access controls to limit access to wherever the configuration information is
+ * stored.
+ *
+ * Please note that adding another layer of encryption does not make the
+ * attackers job much more difficult. Somewhere there must be a master "secret"
+ * that is stored unencrypted on the application platform (unless you are
+ * willing to prompt for some passphrase when you application starts or insert
+ * a USB thumb drive or an HSM card, etc., in which case this master "secret"
+ * it would only be in memory). Creating another layer of indirection provides
+ * additional obfuscation, but doesn't provide any real additional security.
+ * It's up to the reference implementation to decide whether this file should
+ * be encrypted or not.
+ *
+ * The ESAPI reference implementation (DefaultSecurityConfiguration.java) does
+ * not encrypt its properties file.
+ *
+ * @author Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security
+ * @since June 1, 2007
+ */
+public interface SecurityConfiguration extends EsapiPropertyLoader {
+
+ /**
+ * Gets the application name, used for logging
+ *
+ * @return the name of the current application
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getApplicationName();
+
+ /**
+ * Returns the fully qualified classname of the ESAPI Logging implementation.
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getLogImplementation();
+
+ /**
+ * Returns the fully qualified classname of the ESAPI Authentication implementation.
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getAuthenticationImplementation();
+
+ /**
+ * Returns the fully qualified classname of the ESAPI Encoder implementation.
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getEncoderImplementation();
+
+ /**
+ * Returns the fully qualified classname of the ESAPI Access Control implementation.
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getAccessControlImplementation();
+
+ /**
+ * Returns the fully qualified classname of the ESAPI Intrusion Detection implementation.
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getIntrusionDetectionImplementation();
+
+ /**
+ * Returns the fully qualified classname of the ESAPI Randomizer implementation.
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getRandomizerImplementation();
+
+ /**
+ * Returns the fully qualified classname of the ESAPI Encryption implementation.
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getEncryptionImplementation();
+
+ /**
+ * Returns the fully qualified classname of the ESAPI Validation implementation.
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getValidationImplementation();
+
+ /**
+ * Returns the validation pattern for a particular type
+ * @param typeName
+ * @return the validation pattern
+ */
+ Pattern getValidationPattern( String typeName );
+
+ /**
+ * Determines whether ESAPI will accept "lenient" dates when attempt
+ * to parse dates. Controlled by ESAPI property
+ * {@code Validator.AcceptLenientDates}, which defaults to {@code false}
+ * if unset.
+ *
+ * @return True if lenient dates are accepted; false otherwise.
+ * @see java.text.DateFormat#setLenient(boolean)
+ * @deprecated Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ boolean getLenientDatesAccepted();
+
+ /**
+ * Returns the fully qualified classname of the ESAPI OS Execution implementation.
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getExecutorImplementation();
+
+ /**
+ * Returns the fully qualified classname of the ESAPI HTTPUtilities implementation.
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getHTTPUtilitiesImplementation();
+
+ /**
+ * Gets the master key. This password is used to encrypt/decrypt other files or types
+ * of data that need to be protected by your application.
+ *
+ * @return the current master key
+ * @deprecated Use SecurityConfiguration.getByteArrayProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ byte[] getMasterKey();
+
+ /**
+ * Retrieves the upload directory as specified in the ESAPI.properties file.
+ * @return the upload directory
+ */
+ File getUploadDirectory();
+
+ /**
+ * Retrieves the temp directory to use when uploading files, as specified in ESAPI.properties.
+ * @return the temp directory
+ */
+ File getUploadTempDirectory();
+
+ /**
+ * Gets the key length to use in cryptographic operations declared in the ESAPI properties file.
+ * Note that this corresponds to the ESAPI property Encryptor.EncryptionKeyLength which is
+ * considered the default key size that ESAPI will use for symmetric
+ * ciphers supporting multiple key sizes. (Note that there is also an Encryptor.MinEncryptionKeyLength,
+ * which is the minimum key size (in bits) that ESAPI will support
+ * for encryption. (There is no minimum for decryption.)
+ *
+ * @return the key length (in bits)
+ * @deprecated Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ int getEncryptionKeyLength();
+
+ /**
+ * Gets the master salt that is used to salt stored password hashes and any other location
+ * where a salt is needed.
+ *
+ * @return the current master salt
+ * @deprecated Use SecurityConfiguration.getByteArrayProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ byte[] getMasterSalt();
+
+ /**
+ * Gets the allowed executables to run with the Executor.
+ *
+ * @return a list of the current allowed file extensions
+ */
+ List
+ * cipher_alg/cipher_mode[bits]/padding_scheme
+ *
+ * where cipher_alg is the JCE cipher algorithm (e.g., "DESede"),
+ * cipher_mode is the cipher mode (e.g., "CBC", "CFB", "CTR", etc.),
+ * and padding_scheme is the cipher padding scheme (e.g., "NONE" for
+ * no padding, "PKCS5Padding" for PKCS#5 padding, etc.) and where
+ * [bits] is an optional bit size that applies to certain cipher
+ * modes such as {@code CFB} and {@code OFB}. Using modes such as CFB and
+ * OFB, block ciphers can encrypt data in units smaller than the cipher's
+ * actual block size. When requesting such a mode, you may optionally
+ * specify the number of bits to be processed at a time. This generally must
+ * be an integral multiple of 8-bits so that it can specify a whole number
+ * of octets.
+ *
+ * Examples are: + *
+ * "AES/ECB/NoPadding" // Default for ESAPI Java 1.4 (insecure) + * "AES/CBC/PKCS5Padding" // Default for ESAPI Java 2.0 + * "DESede/OFB32/PKCS5Padding" + *+ * NOTE: Occasionally, in cryptographic literature, you may also + * see the key size (in bits) specified after the cipher algorithm in the + * cipher transformation. Generally, this is done to account for cipher + * algorithms that have variable key sizes. The Blowfish cipher for example + * supports key sizes from 32 to 448 bits. So for Blowfish, you might see + * a cipher transformation something like this: + *
+ * "Blowfish-192/CFB8/PKCS5Padding" + *+ * in the cryptographic literature. It should be noted that the Java + * Cryptography Extensions (JCE) do not generally support this (at least + * not the reference JCE implementation of "SunJCE"), and therefore it + * should be avoided. + * @return The cipher transformation. + * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead. + */ + @Deprecated + String getCipherTransformation(); + + /** + * Set the cipher transformation. This allows a different cipher transformation + * to be used without changing the {@code ESAPI.properties} file. For instance + * you may normally want to use AES/CBC/PKCS5Padding, but have some legacy + * encryption where you have ciphertext that was encrypted using 3DES. + * + * @param cipherXform The new cipher transformation. See + * {@link #getCipherTransformation} for format. If + * {@code null} is passed as the parameter, the cipher + * transformation will be set to the the default taken + * from the property {@code Encryptor.CipherTransformation} + * in the {@code ESAPI.properties} file. BEWARE: + * there is NO sanity checking here (other than + * the empty string, and then, only if Java assertions are + * enabled), so if you set this wrong, you will not get + * any errors until you later try to use it to encrypt + * or decrypt data. + * @return The previous cipher transformation is returned for convenience, + * with the assumption that you may wish to restore it once you have + * completed the encryption / decryption with the new cipher + * transformation. + * @deprecated To be replaced by new class in ESAPI 2.1, but here if you need it + * until then. Details of replacement forthcoming to ESAPI-Dev + * list. Most likely to be replaced by a new CTOR for + * JavaEncryptor that takes a list of properties to override. + */ + @Deprecated + String setCipherTransformation(String cipherXform); + + /** + * Retrieve the preferred JCE provider for ESAPI and your application. + * ESAPI 2.0 now allows setting the property + * {@code Encryptor.PreferredJCEProvider} in the + * {@code ESAPI.properties} file, which will cause the specified JCE + * provider to be automatically and dynamically loaded (assuming that + * {@code SecurityManager} permissions allow) as the Ii>preferred + * JCE provider. (Note this only happens if the JCE provider is not already + * loaded.) This method returns the property {@code Encryptor.PreferredJCEProvider}. + * + * By default, this {@code Encryptor.PreferredJCEProvider} property is set + * to an empty string, which means that the preferred JCE provider is not + * changed. + * @return The property {@code Encryptor.PreferredJCEProvider} is returned. + * @see org.owasp.esapi.crypto.SecurityProviderLoader + * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead. + */ + @Deprecated + String getPreferredJCEProvider(); + +// TODO - DISCUSS: Where should this web page (below) go? Maybe with the Javadoc? But where? +// Think it makes more sense as part of the release notes, but OTOH, I +// really don't want to rewrite this as a Wiki page either. + /** + * Determines whether the {@code CipherText} should be used with a Message + * Authentication Code (MAC). Generally this makes for a more robust cryptographic + * scheme, but there are some minor performance implications. Controlled by + * the ESAPI property Encryptor.CipherText.useMAC. + *
+ * For further details, see the "Advanced Usage" section of + * + * "Why Is OWASP Changing ESAPI Encryption?". + *
+ * @return {@code true} if a you want a MAC to be used, otherwise {@code false}. + * @deprecated Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead. + */ + @Deprecated + boolean useMACforCipherText(); + + /** + * Indicates whether the {@code PlainText} objects may be overwritten after + * they have been encrypted. Generally this is a good idea, especially if + * your VM is shared by multiple applications (e.g., multiple applications + * running in the same J2EE container) or if there is a possibility that + * your VM may leave a core dump (say because it is running non-native + * Java code. + *+ * Controlled by the property {@code Encryptor.PlainText.overwrite} in + * the {@code ESAPI.properties} file. + *
+ * @return True if it is OK to overwrite the {@code PlainText} objects + * after encrypting, false otherwise. + * @deprecated Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead. + */ + @Deprecated + boolean overwritePlainText(); + + /** + * Get a string indicating how to compute an Initialization Vector (IV). + * Currently supported modes are "random" to generate a random IV or + * "fixed" to use a fixed (static) IV. + * + * WARNING: 'fixed' was only intended to support legacy applications with + * fixed IVs, but the use of non-random IVs is inherently insecure, + * especially for any supported cipher mode that is considered a streaming mode + * (which is basically anything except CBC for modes that support require an IV). + * For this reason, 'fixed' has now been removed (it was considered deprecated + * since release 2.2.0.0). An ESAPI.properties value of {@code fixed} for the property + * {@code Encryptor.ChooseIVMethod} will now result in a {@code ConfigurationException} + * being thrown. + * + * @return A string specifying the IV type. Should be "random". Anything + * else should fail with a {@code ConfigurationException} being thrown. + * + * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead. + * This method will be removed in a future release as it is now moot since + * it can only legitimately have the single value of "random". + */ + @Deprecated + String getIVType(); + + /** + * Return a {@code List} of strings of combined cipher modes that support + * both confidentiality and authenticity. These would be preferred + * cipher modes to use if your JCE provider supports them. If such a + * cipher mode is used, no explicit separate MAC is calculated as part of + * the {@code CipherText} object upon encryption nor is any attempt made + * to verify the same on decryption. + *
+ * The list is taken from the comma-separated list of cipher modes specified
+ * by the ESAPI property
+ * {@code Encryptor.cipher_modes.combined_modes}.
+ *
+ * @return The parsed list of comma-separated cipher modes if the property
+ * was specified in {@code ESAPI.properties}; otherwise the empty list is
+ * returned.
+ */
+ List
+ * The list is taken from the comma-separated list of cipher modes specified
+ * by the ESAPI property
+ * {@code Encryptor.cipher_modes.additional_allowed}.
+ *
+ * @return The parsed list of comma-separated cipher modes if the property
+ * was specified in {@code ESAPI.properties}; otherwise the empty list is
+ * returned.
+ *
+ * @see #getCombinedCipherModes()
+ */
+ List
+ * A user account can be in one of several states. When first created, a User should be disabled, not expired, and
+ * unlocked. To start using the account, an administrator should enable the account. The account can be locked for a
+ * number of reasons, most commonly because they have failed login for too many times. Finally, the account can expire
+ * after the expiration date has been reached. The User must be enabled, not expired, and unlocked in order to pass
+ * authentication.
+ *
+ * @author Jeff Williams at Aspect Security
+ * @author Chris Schmidt (chrisisbeef .at. gmail.com) Digital Ritual Software
+ * @since June 1, 2007
+ */
+
+public interface User extends Principal, Serializable {
+ /**
+ * @return the locale
+ */
+ Locale getLocale();
+
+ /**
+ * @param locale the locale to set
+ */
+ void setLocale(Locale locale);
+
+ /**
+ * Adds a role to this user's account.
+ *
+ * @param role
+ * the role to add
+ *
+ * @throws AuthenticationException
+ * the authentication exception
+ */
+ void addRole(String role) throws AuthenticationException;
+
+ /**
+ * Adds a set of roles to this user's account.
+ *
+ * @param newRoles
+ * the new roles to add
+ *
+ * @throws AuthenticationException
+ * the authentication exception
+ */
+ void addRoles(Set
+ * Note: This does not get the configured response content type. That is accessed by calling
+ * getResponseContentType().
+ *
+ * @return the current character encoding scheme
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getCharacterEncoding();
+
+ /**
+ * Return true if multiple encoding is allowed
+ *
+ * @return whether multiple encoding is allowed when canonicalizing data
+ * @deprecated Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ boolean getAllowMultipleEncoding();
+
+ /**
+ * Return true if mixed encoding is allowed
+ *
+ * @return whether mixed encoding is allowed when canonicalizing data
+ * @deprecated Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ boolean getAllowMixedEncoding();
+
+ /**
+ * Returns the List of Codecs to use when canonicalizing data
+ *
+ * @return the codec list
+ */
+ List
+ * Note: This does not get the configured character encoding scheme. That is accessed by calling
+ * getCharacterEncoding().
+ *
+ * @return The current content-type set for responses.
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getResponseContentType();
+
+ /**
+ * This method returns the configured name of the session identifier,
+ * likely "JSESSIONID" though this can be overridden.
+ *
+ * @return The name of the session identifier, like "JSESSIONID"
+ * @deprecated Use SecurityConfiguration.getStringProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ String getHttpSessionIdName();
+
+ /**
+ * Gets the length of the time to live window for remember me tokens (in milliseconds).
+ *
+ * @return The time to live length for generated "remember me" tokens.
+ */
+ // OPEN ISSUE: Can we replace w/ SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead?
+ long getRememberTokenDuration();
+
+
+ /**
+ * Gets the idle timeout length for sessions (in milliseconds). This is the amount of time that a session
+ * can live before it expires due to lack of activity. Applications or frameworks could provide a reauthenticate
+ * function that enables a session to continue after reauthentication.
+ *
+ * @return The session idle timeout length.
+ * @deprecated Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ int getSessionIdleTimeoutLength();
+
+ /**
+ * Gets the absolute timeout length for sessions (in milliseconds). This is the amount of time that a session
+ * can live before it expires regardless of the amount of user activity. Applications or frameworks could
+ * provide a reauthenticate function that enables a session to continue after reauthentication.
+ *
+ * @return The session absolute timeout length.
+ * @deprecated Use SecurityConfiguration.getIntProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ int getSessionAbsoluteTimeoutLength();
+
+
+ /**
+ * Returns whether HTML entity encoding should be applied to log entries.
+ *
+ * @return True if log entries are to be HTML Entity encoded. False otherwise.
+ * @deprecated Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ boolean getLogEncodingRequired();
+
+ /**
+ * Returns whether ESAPI should log the application name. This might be clutter in some
+ * single-server/single-app environments.
+ *
+ * @return True if ESAPI should log the application name, False otherwise
+ * @deprecated Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ boolean getLogApplicationName();
+
+ /**
+ * Returns whether ESAPI should log the server IP. This might be clutter in some
+ * single-server environments.
+ *
+ * @return True if ESAPI should log the server IP and port, False otherwise
+ * @deprecated Use SecurityConfiguration.getBooleanProp("appropriate_esapi_prop_name") instead.
+ */
+ @Deprecated
+ boolean getLogServerIP();
+
+ /**
+ * Models a simple threshold as a count and an interval, along with a set of actions to take if
+ * the threshold is exceeded. These thresholds are used to define when the accumulation of a particular event
+ * has met a set number within the specified time period. Once a threshold value has been met, various
+ * actions can be taken at that point.
+ */
+ class Threshold {
+
+ /** The name of this threshold. */
+ public String name = null;
+
+ /** The count at which this threshold is triggered. */
+ public int count = 0;
+
+ /**
+ * The time frame within which 'count' number of actions has to be detected in order to
+ * trigger this threshold.
+ */
+ public long interval = 0;
+
+ /**
+ * The list of actions to take if the threshold is met. It is expected that this is a list of Strings, but
+ * your implementation could have this be a list of any type of 'actions' you wish to define.
+ */
+ public List
+ * assert StringUtils.notNullOrEmpty(cipherXform, true) :
+ * "Cipher transformation may not be null or empty!";
+ *
+ * or an equivalent runtime check that throws an {@code IllegalArgumentException}.
+ *
+ * @param str The {@code String} to be checked.
+ * @param trim If {@code true}, the string is first trimmed before checking
+ * to see if it is empty, otherwise it is not.
+ * @return True if the string is null or empty (after possible
+ * trimming); otherwise false.
+ * @since 2.0
+ */
+ public static boolean notNullOrEmpty(String str, boolean trim) {
+ if ( trim ) {
+ return !( str == null || str.trim().equals("") );
+ } else {
+ return !( str == null || str.equals("") );
+ }
+ }
+
+ /**
+ * Returns true if String is empty ("") or null.
+ */
+ public static boolean isEmpty(String str) {
+ return str == null || str.length() == 0;
+ }
+}
diff --git a/src/main/java/org/owasp/esapi/User.java b/src/main/java/org/owasp/esapi/User.java
new file mode 100644
index 000000000..fc5ca980c
--- /dev/null
+++ b/src/main/java/org/owasp/esapi/User.java
@@ -0,0 +1,760 @@
+/**
+ * OWASP Enterprise Security API (ESAPI)
+ *
+ * This file is part of the Open Web Application Security Project (OWASP)
+ * Enterprise Security API (ESAPI) project. For details, please see
+ * http://www.owasp.org/index.php/ESAPI.
+ *
+ * Copyright (c) 2007 - The OWASP Foundation
+ *
+ * The ESAPI is published by OWASP under the BSD license. You should read and accept the
+ * LICENSE before you use, modify, and/or redistribute this software.
+ *
+ * @author Jeff Williams Aspect Security
+ * @created 2007
+ */
+package org.owasp.esapi;
+
+import org.owasp.esapi.errors.AuthenticationException;
+import org.owasp.esapi.errors.AuthenticationHostException;
+import org.owasp.esapi.errors.EncryptionException;
+
+import javax.servlet.http.HttpSession;
+import java.io.Serializable;
+import java.security.Principal;
+import java.util.*;
+
+/**
+ * The User interface represents an application user or user account. There is quite a lot of information that an
+ * application must store for each user in order to enforce security properly. There are also many rules that govern
+ * authentication and identity management.
+ *